Intrusion detection is achieved by a universal, powerfull and efficient audit trail analysis.
This is achieved by means of user provided Format Adaptors translating the native format to the Normalized Audit Data format. Here is an abstract of a paper on this to appear in the proceedings of the ISOC'95 Symposium on Network and Distributed System Security. An implemented system for on-line analysis of multiple distributed data streams is presented. The system is conceptually universal since it does not rely on any particular platform feature and uses format adaptors to translate data streams into its own standard format. In this paper, the generic concepts are applied to security audit trail analysis.