Modeling multi-level intrusions in Z language
Chaohui Zhuang, Chenhui Yang, Changle Zhou · 2004
An attack specification language is constructed based on enhanced attack tree model first, but this language is not power enough to depict some characters of multi-level intrusions. To address this problem, a more powerful language, Z language, is introduced to define the attack schemas. In this language, the representations of relations among nodes are given. Then, a construction of IP/spl I.bar/Spoofing attack schemas exemplifies this method and how to detect IP/spl I.bar/Spoofing attack is discussed. Based on this method, an experimental system ADIDS has been built to demonstrate the feasibility of this method.