Software Fault Tree and Colored Petri Net Based Specification, Design and Implementation of Agent-Based Intrusion Detection Systems
Guy Helmer, Johnny S.K. Wong, Mark Slagell, Vasant Honavar, Les Miller, Yanxin Wang, Xia Wang, Natalia Stakhanova · 2001
Colored Petri Nets (CPNs) are examined for use as a design specification for an Intrusion Detection System (IDS). Hierarchical CPNs are created to detect critical stages of intrusions. Two examples of intrusions demonstrate how the Colored Petri Net approach has been used in development of the IDS. The IDS under development is a collection of mobile agents that detect, classify, and correlate system and network activities. The approach of using Colored Petri Nets to design and implement the agent-based IDS is described. Software Fault Trees (SFTs), augmented with nodes that describe trust, temporal, and contextual relationships, are used to describe intrusions. CPNs for intrusion detection are built using CPN templates created from the augmented SFTs. The agent-based implementation of the IDS is constructed from the CPNs. Contributions of this paper include (1) the use of temporality to divide stages of intrusions, (2) augmentation of Software Fault Trees with trust, temporal, ...