Defining High-Level Signatures Using the Footprint Mark-up Language (FTML)

Abstract

The computer misuse model of intrusion detection focuses upon single events, and attempts to extrapolate from this starting point to identify an attack. It has long been understood that computer intrusions are multifaceted complex entities that evolve over time. Current applications of the computer misuse model are narrow and lack depth when applied to the analysis of complex attacks that cannot be understood simply by examining packets in an isolated fashion without regards of the general context in which they occur. In this paper, a mark-up language that draws upon the state transition model of signatures is presented and extends it in allowing us to express complex and evolving attacks using the concept of a footprint.