Intrusion detection systems have been around for quite some time. Typically, these systems look for attack signatures. However, newer systems are starting to look at anomalous behaviors. Techniques from the machine learning field are being used to automatically construct nominal program and network behaviors and to then look for anomalous activities. Such systems have proven extremely useful in the credit card fraud detection field.
Anomaly detection fits perfectly into test output and log analysis.
The ability to filter anomalous and nominal tests for human inspection is very interesting and perhaps a nice method of improving test efficiency. In addition, testing is a perfect fit for anomaly detection in that data may be generated on demand and in high quantity. In addition, the mechanisms used for some intrusion detection work can have direct impact into automating the instrumentation of programs. Specifically, system call tracing and the hooking shared objects can provide instrumentation methods even for COTS products where the instrumentation process is normally impossible. This article describes a quantitative approach to managing critical barriers to achieving consensus on technological, business case, and organizational issues of architecture-based product line development.