Privacy-Respecting Intrusion Detection

Privacy-Respecting Intrusion Detection

By (author) 

Free delivery worldwide

Available. Expected delivery to the United States in 9-14 business days.


Not ordering to the United States? Click here.

Description

Effective response to misuse or abusive activity in IT systems requires the capability to detect and understand improper activity. Intrusion Detection Systems observe IT activity, record these observations in audit data, and analyze the collected audit data to detect misuse. Privacy-Respecting Intrusion Detection introduces the concept of technical purpose binding, which restricts the linkability of pseudonyms in audit data to the amount necessary for misuse detection. Also, it limits the recovery of personal data to pseudonyms involved in a detected misuse scenario. The book includes case studies demonstrating this theory, and solutions that are constructively validated by providing algorithms.
show more

Product details

  • Paperback | 307 pages
  • 155 x 235 x 17.53mm | 504g
  • New York, NY, United States
  • English
  • Softcover reprint of hardcover 1st ed. 2007
  • 14 Tables, black and white; 61 Illustrations, black and white; XX, 307 p. 61 illus.
  • 1441941754
  • 9781441941756

Back cover copy

With our society's growing dependency on information technology systems (IT), IT security is crucial. To properly respond to misuse or abusive activity in IT systems, one needs to establish the capability to detect and understand improper activity. Intrusion Detection Systems observe activity occurring in the IT system, record these observations in audit data, and analyze collected audit data to detect misuse. Collecting and processing audit data for misuse detection conflicts with expectations and rights of system users regarding their privacy. A viable solution is replacing personal data with pseudonyms in audit data.

Privacy-Respecting Intrusion Detection introduces technical purpose binding, restricting the linkability of pseudonyms in audit data, to the amount required for misuse detection. Also, it limits the recovery of original personal data to pseudonyms involved in a detected misuse scenario. This book includes case studies with constructively validated solutions by providing algorithms.



Privacy-Respecting Intrusion Detection is designed for a professional audience, composed of practitioners and researchers in industry. This book is also suitable as an advance-level text in the computer science field.

Foreword by Richard Kemmerer, University of California, Santa Barbara, USA
show more

Table of contents

and Background.- Authorizations.- An Architectural Model for Secure Authorizations.- Traditional Security Objectives.- Personal Data Protection Objectives.- The Challenge: Technical Enforcement of Multilateral Security.- Pseudonyms - A Technical Point of View.- An Architectural Model for Pseudonymous and Secure Authorizations.- Comparing Architectures.- Audit Data Pseudonymization.- Set-based Approach.- Requirements, Assumptions and Trust Model.- Modeling Conditions for Technical Purpose Binding of Controlled Pseudonym Disclosure.- Cryptographic Enforcement of Disclosure Conditions.- The Mismatch Problem.- Operational Pseudonymization and Pseudonym Disclosure.- Extensions.- Application to Unix Audit Data.- Unix Audit Data.- Syslog.- Instantiating the Set-based Approach for Syslog-style Audit Data.- Implementation: Pseudo/CoRe.- Evaluation.- APES: Anonymity and Privacy in Electronic Services.- Evaluating the Design Using Basic Building Blocks for Anonymity.- Evaluating the Performance of the Implementation.- Refinement of Misuse Scenario Models.- Motivating Model Refinements.- Models of Misuse Scenarios.- Pseudonymization Based on Serial Signature-Nets.- Pseudonym Linkability.- Pseudonym Disclosure.
show more

About Ulrich Flegel

Intrusion detection systems (IDS) monitor computer systems, record audit data and analyze the collected data in order to detect misuse. The recorded audit data documents user behavior and contains personal data of system users. As a result, collecting and processing audit data for misuse detection conflicts with pertinent privacy law. Privacy-Respecting Intrusion Detection introduces the concept of technical purpose binding, which restricts the linkability of pseudonyms in audit data to the amount necessary for misuse detection. Also, it limits the recovery of personal data to pseudonyms involved in a detected misuse scenario. The book includes case studies demonstrating this theory, and solutions that are constructively validated by providing algorithms.
show more