Intrusion detection based on model checking timed interval temporal logic

Interval temporal logic (ITL) model checking reduces the false negative rate of misuse detection for concurrent attacks. However, no ITL formula can be used to describe the time constraints between various actions in the same attack. To this end, we use a timed interval temporal logic (TITL) formula to describe such constraints as well as the absolute time of atomic steps in an attack. On this basis, we give an approach for intrusion detection based on TITL model checking. Compared with the existing misuse detection method based on model checking, the new method can find real-time attacks.