Intruder detection

Short description: Concept in information security

This article relies largely or entirely on a single source. Please help improve this article by introducing citations to additional sources.
Find sources: "Intruder detection" – news · newspapers · books · scholar · JSTOR (December 2024)

|

For network protection devices or software, see Intrusion detection system. For physical systems designed to detect intrusions, see Security alarm.

In information security, intruder detection[1] is the process of detecting intruders behind attacks as unique persons. This technique tries to identify the person behind an attack by analyzing their computational behaviour.

## Contents

* 1 History
* 2 Theory
* 2.1 Some of the parameters used to identify a intruder
* 2.2 Keystroke dynamics
* 3 Translation confusion
* 4 See also
* 5 References
* 6 External links

## History

Some other earlier works reference the concept of Intruder Authentication, Intruder Verification, or Intruder Classification, but the Si6 project was one of the first projects to deal with the full scope of the concept.

## Theory

Intruder Detection Systems try to detect who is attacking a system by analyzing his or her computational behaviour or biometric behaviour.

### Some of the parameters used to identify a intruder

* Keystroke Dynamics (aka keystroke patterns, typing pattern, typing behaviour)
* Patterns using an interactive command interpreter:
* Commands used
* Commands sequence
* Accessed directories
* Character deletion
*   * Patterns on the network usage:
* IP address used
* ISP
* Country
* City
* Ports used
* TTL analysis
* Operating system used to attack
* Protocols used
* Connection times patterns

### Keystroke dynamics

Keystroke dynamics is paramount in Intruder Detection techniques because it is the only parameter that has been classified as a real 'behavioural biometric pattern'.

Keystroke dynamics analyze times between keystrokes issued in a computer keyboard or cellular phone keypad searching for patterns. First techniques used statistics and probability concepts like 'standard deviations' and 'Mean', later approaches use data mining, neural networks, Support Vector Machine, etc.

## Translation confusion

There is a confusion with the Spanish translation of 'Intrusion detection system', also known as IDS. Some people translate it as 'Sistemas de Detección de Intrusiones', but others translate it as 'Sistemas de Detección de Intrusos'[citation needed]. Only the former is correct.

## See also

* Intrusion-detection system
* Biometrics

## References

1. ↑ "What Is an Intruder Detection System?". https://www.augmentt.com/security/network/an-intruder-detection-system/.

## External links

* P0f OS fingerprinting tool
* Si6 Paranoid Project

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Intruder detection. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Intruder_detection&oldid=3991949"