Heuristic rules based on logical & linguistic connection to detect and identify information security intruders

Abstract

Most of existed intruder detection systems based on heu­ristic principle of information security violation detection and oriented on using mathematical models which need a lot time for statistical data preparation. Mathematical models based on expert approach are more effective but they need adequate rules for decision making. For this problem solving in die paper the model of heuristic rules based on fuzzy logic was proposed. This model uses plu­rals "intruder influence - parameter", "intruder influence — set of logical & linguistic connection" and universal model of parameter etalons and allows to display in in­formation system some anomaly generated by influence of some category intruder. On the basis of this model were developed the examples of rules for detection the activity of such categories of intruders as misinformer, hacker, cracker, spammer, bot-braker and spamm-bot. These can be used in practice for the perfection of real intruder detection systems in information systems.