Testing and evaluating computer intrusion detection systems

This article discusses the vulnerability of computer networks in the U.S. and suggests some solutions to keep systems safe from hacking. Computer hackers constantly invent new attacks and disseminate them over the Web. These problems are not limited to the government-many corporations fight industrial espionage daily to protect trade secret information. Juvenile hackers, while not necessarily as malicious as dedicated adversaries, can still wreak significant damage to systems and their defenses. Moreover, disgruntled employees, bribery and coercion make networks vulnerable to attacks from the inside. Computer programs like ActiveX, Java, and increasing reliance on "commercial off-the-shelf" technology help infiltrators make unknowing accomplices of legitimate users. Network-based ID systems monitor network traffic between hosts. Unlike host-based ID systems, which detect malicious behavior outright, these systems deduce behavior based on the content and format of data packets on the network. Among other things, they analyze overt requests for sensitive information and repeated failed attempts to violate security policy. Many current network-based ID systems are quite primitive, only watching for the words and commands of a hacker's vocabulary. INSET: More information on specific research projects is available at:.