NetSTAT: a network-based intrusion detection approach

Abstract

Network-based attacks have become common and so- phisticated. For this reason, intrusion detection systems are now shifting their focus from the hosts and their operating systems to the network itself. Network-based intrusion de- tection is challenging because network auditing produces large amounts of data, and different events related to a sin- gle intrusion may be visible in different places on the net- work. This paper presents NetSTAT, a new approach to net- work intrusion detection. By using a formal model of both the network and the attacks, NetSTAT is able to determine which network events have to be monitored and where they can be monitored.