La détection d'intrusions: Les outils doivent coopérer

Intruder detection systems seek to detect all violations of the security policy applied to a data processing system. The systems work by analysing all events occurring in the system, either in real time or in batch mode. Two main approaches are used, a scenario based approach (misuse detection) and a behavioural approach (anomaly detection). Each of the two approaches has its own strengths and weaknesses, and these are reflected in the tools that make use of them. The article aims to demonstrate to need for cooperation between intruder detection tools in order to combine the strengths and eliminate the weaknesses.