a formal approach to sensor placement and configuration in a network intrusion detection system
Network Intrusion Detection Systems (NIDSs) can be composed of a potentially large number of sensors, which monitor the traffic flowing in the network. Deciding where sensors should be placed and what information they need in order to detect the desired attacks can be a demanding task for network administrators, one that should be made as automatic as possible. This paper presents a logic-based model that is suitable for describing networks and intrusions. The model has been implemented in Prolog, and allows to analyze some important static properties of networks. In particular, it can be used to automatically determine, given a suitable formal definition of an attack, the location and/or the information needed by a NIDS sensor to detect the attack.
sensor placement intrusion detection systems formal model network analysis sensor configuration