Accession Number:

ADA439818

Title:

Implementing a Patternless Intrusion Detection System; A Methodology for Zippo

Descriptive Note:

Master's thesis

Corporate Author:

NAVAL POSTGRADUATE SCHOOL MONTEREY CA

Personal Author(s):

Report Date:

2005-09-01

Pagination or Media Count:

125.0

Abstract:

A methodology for the implementation of Zippo, a patternless intrusion detection system is presented in this thesis. This methodology approaches the implementation in a holistic manner to include the administrative and operational tasks necessary for ensuring proper preparation for Zippos use. Prior to implementing and using Zippo, a basic understanding of TCPIP and intrusion detection systems is needed and these topics are presented in broad detail. The origin of Zippo starts with the creation of Therminator, which is discussed in detail. The architecture and configuration of Zippo are based on those of Therminator and understanding the ideas of buckets and balls, thermal canyons and towers, decision trees, slidelength and windowlength and initial and boundary conditions are paramount to understanding the Zippo application. To successfully implement Zippo, other network factors must be attended to including the topology, organizational policies and the security plan. Once these factors are addressed, Zippo can be optimally configured to successfully be installed on a network. Finally, previous research done on Zippo yielded decision trees and thermal canyons pertaining to protocol specific threats that are presented to familiarize the reader with Zippos visual representation of malicious or anomalous behavior.

Subject Categories:

  • Acoustic Detection and Detectors
  • Thermodynamics

Distribution Statement:

APPROVED FOR PUBLIC RELEASE