| || || || || |
The Inquisitive Sensor: A Tactical Tool for System Survivability
by Dr. Ulf Lindqvist.
In Supplement of the 2001 International Conference on Dependable Systems and Networks, pages C-14–C-16, Göteborg,
Sweden, July 1–4, 2001.
This paper proposes methods by which traditionally passive
intrusion detection sensors can be instrumented to take
certain tactical actions in order to increase the certainty by
which they can make decisions. Examples show how a sensor
can request injection of additional data into the event
data stream it is monitoring, as a reaction to its observation
of incomplete indications of threats. As the threat level
increases, the sensor could increase its degree of activeness
and thereby its visibility. When a system is under attack,
an accurate and timely situation assessment enabling effective
countermeasures is probably more important to system
survivability than keeping the sensors concealed.