eXpert-BSM is a real time forward-reasoning expert system that analyzes Sun Solaris audit trails. Based on many years of intrusion detection research, eXpert-BSM’s knowledge base detects a wide range of specific and general forms of misuse, provides detailed reports and recommendations to the system operator, and has a low false-alarm rate. Host-based intrusion detection offers the ability to detect misuse and subversion through the direct monitoring of processes inside the host, providing an important complement to network-based surveillance. Suites of eXpert-BSMs may be deployed throughout a network, and their alarms managed, correlated, and acted on by remote or local subscribing security services, thus helping to address issues of decentralized management.
When research on intrusion detection was initiated in the early 1980s, the problem was often referred to as automated audit-trail analysis. In theory, auditing is an important security service that both establishes accountability for users and aids in damage assessment once an abuse is discovered.
Unfortunately, in practice the volumes of data that tend to be produced by audit services are such that any security violation recorded within the audit trail is often secure from discovery as well. The increasing speed and complexity of modern computing environments has increased the volumes of audit data that can be produced.
Download this whitepaper now.