String distances and intrusion detection: Bridging the gap between formal languages and computer security

Issue		RAIRO-Theor. Inf. Appl. Volume 40, Number 2, April-June 2006 Alberto Bertoni: Climbing summits


Page(s)		303 - 313
DOI		10.1051/ita:2006010
Published online		20 July 2006

Theoret. Informatics Appl. 40, 303-313 (2006)
DOI: 10.1051/ita:2006010

String distances and intrusion detection: Bridging the gap between formal languages and computer security

Danilo Bruschi and Giovanni Pighizzini

Dipartimento di Informatica e Comunicazione, Università degli Studi di Milano, via Comelico, 39, 20135 Milano, Italy; bruschi@dico.unimi.it,pighizzi@dico.unimi.it

(Published online 20 July 2006)

Abstract
In this paper we analyze some intrusion detection strategies proposed in the literature and we show that they represent the various facets of a well known formal languages problem: computing the distance between a string x and a language L. In particular, the main differences among the various approaches adopted for building intrusion detection systems can be reduced to the characteristics of the language L and to the notion of distance adopted. As a further contribution we will also show that from the computational point of view all these strategies are equivalent and they are amenable to efficient parallelization.

What is OpenURL?

The OpenURL standard is a protocol for transmission of metadata describing the resource that you wish to access. An OpenURL link contains article metadata and directs it to the OpenURL server of your choice. The OpenURL server can provide access to the resource and also offer complementary services (specific search engine, export of references...). The OpenURL link can be generated by different means.

If your librarian has set up your subscription with an OpenURL resolver, OpenURL links appear automatically on the abstract pages.
You can define your own OpenURL resolver with your EDPS Account. In this case your choice will be given priority over that of your library.
You can use an add-on for your browser (Firefox or I.E.) to display OpenURL links on a page (see http://www.openly.com/openurlref/). You should disable this module if you wish to use the OpenURL server that you or your library have defined.