A proposal of protocol and policy-based intrusion detection system

Currently, intrusion detection systems (IDSs) are widely deployed in enterprise networks for detecting network attacks. Most existing commercial IDSs are based on misuse detection model. In misuse detection, although known attacks can be detected, unknown attacks cannot be detected because attack signatures for unknown attacks cannot be generated. In this paper, we propose a method for detecting network attacks including unknown ones against servers such as web servers, mail servers, FTP servers, and DNS servers, using protocol specifications and site access policy. Furthermore, we propose a method to predict damage from detected attacks using neural networks.