Modulating application behaviour for closely coupled intrusion detection

Welz, Marc

Modulating application behaviour for closely coupled intrusion detection

Doctoral Thesis

2003

Publisher

University of Cape Town

Department

Department of Computer Science

Faculty

Faculty of Science

Abstract

This thesis presents a security measure that is closely coupled to applications. This distinguishes it from conventional security measures which tend to operate at the infrastructure level (network, operating system or virtual machine). Such lower level mechanisms exhibit a number of limitations, amongst others they are poorly suited to the monitoring of applications which operate on encrypted data or the enforcement of security policies involving abstractions introduced by applications. In order to address these problems, the thesis proposes externalising the security related analysis functions performed by applications. These otherwise remain hidden in applications and so are likely to be underdeveloped, inflexible or insular. It is argued that these deficiencies have resulted in an over-reliance on infrastructure security components.

Description

Includes bibliographical references.

Keywords

Computer Science

Reference:

Collections

PhD / Doctoral

Full item page