The Kerf toolkit for intrusion analysis

Author

Aslam, Javed ; Bratus, Sergey ; Kotz, David ; Peterson, Ron ; Rus, Daniela ; Tofel, Brett

Author_Institution

Dept. of Comput. Sci., Dartmouth Coll., Hanover, NH, USA

fYear

2003

fDate

18-20 June 2003

Firstpage

301

Lastpage

303

Abstract

We consider the problem of intrusion analysis and present the Kerf toolkit, whose purpose is to provide an efficient and flexible infrastructure for the analysis of attacks. The Kerf toolkit includes a mechanism for securely recording host and network logging information for a network of workstations, a domain-specific language for querying this stored data, and an interface for viewing the results of such a query, providing feedback on these results, and generating new queries in an iterative fashion. We describe the architecture of Kerf in detail, present examples to demonstrate the power of our query language, and discuss the performance of our implementation of this system.

Keywords

computer crime; data visualisation; query languages; query processing; system monitoring; workstation clusters; Kerf toolkit; domain-specific query language; graphical interface; host information; information recording; intrusion analysis; network logging information; query processing; Automatic testing; Computer science; Database languages; Domain specific languages; Educational institutions; Feedback; Indexing; Spatial databases; System testing; Workstations;

fLanguage

English

Publisher

ieee

Conference_Titel

Information Assurance Workshop, 2003. IEEE Systems, Man and Cybernetics Society

Print_ISBN

0-7803-7808-3

Type

conf

DOI

10.1109/SMCSIA.2003.1232441

Filename

1232441