Detection of Mailbomb Attacks Base on Time Interval Temporal Logic
Qinglei Zhou, Wei Hu, Weijun Zhu · 2015
Compared with other methods, intrusion detection approaches based on temporal logics can deal with many complicated network attacks effectively. Mail bomb attacks, however, are unable to be detected by the above methods due to the lack of formalization models. Thus, we use Time Interval Temporal Logic (TITL) to create a model for this type of attacks. At first, the attack principle is analyzed, and the attack details are decomposed into atomic actions. On this basis, the atomic actions are translated into action sequences. At last, the attack is described as a temporal logic formula. The obtained model formulas can be used as input of a model checker, i.e., The intrusion detector, with the automaton representing the logs as another input of the model checker, i.e., Intrusion detector. Thus, the result of model checking is the one of intrusion detection. Simulation experiments verified the validity of the new method.