An intrusion detection approach by behavior specification

Abstract

This paper describes literature works in intrusion detection field. After that, we propose an intrusion detection method in Linux/Unix commands using supervisor synthesis. This method was applied to distinct normal user behavior from intruders behavior. The main features of this work are twofold. It exploits supervisor synthesis in the intrusion detection field. It presents our approach by behavior specification. Two advantages characterize our proposed algorithm for detection. The first advantage is that the algorithm result is a structure. The second advantage is the way of searching faults or intrusions.