Using Constraints for Intrusion Detection: the NeMODe System

Pedro Salgueiro , Daniel Diaz (1) , Isabel Brito (2) , Salvador Abreu (3)

1 CRI - Centre de Recherche en Informatique de Paris 1
2 CURIE-BIOINFO - Service de Bioinformatique
3 CENTRIA - Centre for Artificial Intelligence

In this work we present NeMODe a declarative system for Computer Network Intrusion detection which provides a declarative Domain Specific Language for describing computer network intrusion signatures that could spread across several network packets, which allows to state constraints over network packets, describing relations between several packets, and providing several back-end detection mechanisms which relies on Constraint Programming (CP) methodologies to find those intrusions.

Mots clés: Constraint Programming; Itrusion Detection Systems; Domain Specific Languages

Pedro Salgueiro, Daniel Diaz, Isabel Brito, Salvador Abreu. Using Constraints for Intrusion Detection: the NeMODe System. 13th International Symposium, PADL 2011, Jan 2011, Austin, Texas, United States. pp.115-129, ⟨10.1007/978-3-642-18378-2_11⟩. ⟨hal-00663805⟩