The use of artificial immune systems in intrusion detection is an appealing concept for two
reasons. Firstly, the human immune system provides the human body with a high level of …

The immune system is highly distributed, highly adaptive, self-organising in nature,
maintains a memory of past encounters and has the ability to continually learn about new …

We present an approach to user re-authentication based on the data collected from the
computer's mouse device. Our underlying hypothesis is that one can successfully model …

This dissertation presents a new approach to managing failures and evolution in large,
complex distributed systems using runtime paths. We use the paths that requests follow as …

Conventional firewalls rely on a strict outside/inside topology where the gateway (s) enforce
some sort of traffic filtering. Some claims that with the evolving connectivity of the Internet …

In anomaly detection, the normal behavior of a process is characterized by a model, and
deviations from the model are called anomalies. In behavior-based approaches to anomaly …

Application sandboxes provide restricted execution environments that limit an application's
access to sensitive OS resources. These systems are an increasingly popular method for …

Abstract Model-based intrusion detection compares a process's execution against a
program model to detect intrusion attempts. Models constructed from static program analysis …

Traffic anomalies such as failures and attacks are increasing in frequency and severity, and
thus identifying them rapidly and accurately is critical for large network operators. The …

A key function of a host-based intrusion detection system is to monitor program execution.
Models constructed using static analysis have the highly desirable feature that they do not …