Secure coprocessor-based intrusion detection
Xiaolan Zhang, Leendert van Doorn, Trent Jaeger, Ronald Perez, Reiner Sailer · 2002
The goal of an intrusion detection system (IDS) is to recognize attacks such that their exploitation can be prevented. Since computer systems are complex, there are a variety of places where detection is possible. For example, analysis of network traffic may indicate an attack in progress [11], a compromised daemon may be detected by its abnormal behavior [14, 12, 5, 10, 15], and subsequent attacks may be prevented by the detection of backdoors and stepping stones [16, 17].