8th European Symposium on Research in Computer Security (ESORICS 2003)
An Improved Reference Flow Control Model for Policy-Based Intrusion Detection
Jacob Zimmermann, Ludovic Mé, Christophe Bidan
Keywords : Policy-based intrusion detection, information flow control, access control
Abstract : In this paper, we describe a novel approach to policy-based intrusion detection. The model we propose checks legality of information flows between objects in the system, according to an existing security policy specification. These flows are generated by executed system operations. Illegal flows, i.e., not authorized by the security policy, are signaled and considered as intrusion symptoms. This model is able to detect a large class of attacks, referred to as attacks by delegation in this paper. Since the approach focuses really on attack effects instead of attack scenarii, unknown attacks by delegation can be detected.
(Pages 291-308)