Abstract
Orchids is an intrusion detection tool based on techniques for fast, on-line model-checking. Temporal formulae are taken from a temporal logic tailored to the description of intrusion signatures. They are checked against merged network and system event flows, which together form a linear Kripke structure.
Partially supported by the RNTL Project DICO, the ACI jeunes chercheurs “Sécurité informatique, protocoles crypto. et détection d’intrusions” and the ACI cryptologie “Psi-Robuste”.
Chapter PDF
Similar content being viewed by others
References
Goubault-Larrecq, J.: Un algorithme pour l’analyse de logs. Research Report LSV-02-18, Lab. Specification and Verification, ENS de Cachan, Cachan, France, 33 pages (November 2002)
Goubault-Larrecq, J., Pouzol, J.-P., Demri, S., Mé, L., Carle, P.: Langages de détection d’attaques par signatures. Sous-projet 3, livrable 1 du projet RNTL DICO. Version 1, 30 pages (June 2002)
Morton, A., Starzetz, P.: Linux kernel do_brk function boundary condition vulnerability. References CAN-2003-0961 (CVE), BugTraq Id 9138 (December 2003), http://www.securityfocus.com/bid/9138
Olivain, J.: ORCHIDS—real-time event analysis and temporal correlation for intrusion detection in information systems (2004), http://www.lsv.ens-cachan.fr/orchids/
Purczyński, W.: Linux kernel privileged process hijacking vulnerability. BugTraq Id 7112 (March 2003), http://www.securityfocus.com/bid/7112
Roger, M., Goubault-Larrecq, J.: Log auditing through model checking. In: Proc. 14th IEEE Computer Security Foundations Workshop (CSFW 2001), Cape Breton, Nova Scotia, Canada, pp. 220–236. IEEE Comp. Soc. Press, Los Alamitos (2001)
Wolper, P.: Temporal logic can be more expressive. Information and Control 56(1/2), 72–99 (1983)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Olivain, J., Goubault-Larrecq, J. (2005). The Orchids Intrusion Detection Tool. In: Etessami, K., Rajamani, S.K. (eds) Computer Aided Verification. CAV 2005. Lecture Notes in Computer Science, vol 3576. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11513988_28
Download citation
DOI: https://doi.org/10.1007/11513988_28
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-27231-1
Online ISBN: 978-3-540-31686-2
eBook Packages: Computer ScienceComputer Science (R0)