查看文章

Detection of zero day exploits is a challenging problem. Vulnerabilities that are known only by attackers but not by software vendors and neither by users have severe impact on security of systems and networks. Such vulnerabilities are exploited to intrude systems and often cause leakage of confidential data. Due to the hitherto unknown pattern of the exploitation, real-time detection is hardly possible. Hence, often an incident is detected only long time after it took place, if it is detected at all. More timely detection of attacks is necessary to trigger suitable counter-measures like reconfiguration of firewalls and sending alerts to administrators of other vulnerable targets. Therefore, to know the attributes of a novel attack’s target system supports the protection of other vulnerable systems. We suggest a novel approach of post-incident intrusion detection system, to be precise—a crowd-based intrusion detection …