Linux - Open Source White Papers
Backtracking Intrusions
Overview Analyzing intrusions is an arduous, largely manual task because system administrators lack the information and tools needed to understand easily the sequence of steps that occurred in an attack. The goal of BackTracker is to identify automatically potential sequences of steps that occurred in an intrusion. Starting with a single detection point (e.g., a suspicious file), BackTracker identifies files and processes that could have affected that detection point and displays chains of events in a dependency graph. The authors use BackTracker to analyze several real attacks against computers that they set up as honeypots. They have implemented BackTracker for Linux in two components: an on-line component that logs events and an off-line component that graphs events related to the attack.
| Publisher | Association for Computing Machinery | File Format | |
|---|---|---|---|
| Date Published | October 2003 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful?
White Paper RSS
Download
Register
