Rapid Prototyping of Intrusion Detection Systems

Designing security softwares that evolve as quickly as threats is a truthful challenge. In addition, current software becomes increasingly more complex and difficult to handle even for security experts. Intrusion Detection Softwares (IDS) represent a solution that can alleviate these concerns. This paper proposes a framework to automatically build an effective online IDS which can check if the program´s expected behavior is respected during the execution. The proposed framework extracts relevant information from the program´s source code to build a dedicated IDS. We use the GCC compiler to produce the structure of our behavior´s model and ensure the IDS is correct. Thanks to Petri nets, our framework allows program offline monitoring and simplifies the online monitoring development.