A Scaled, Immunological Approach to Anomaly Countermeasures [chapter]

Kyrre M. Begnum, Mark Burgess
2003 Integrated Network Management VIII  
We discuss the combination of two anomaly detection models, the Linux kernel module pH and cfengine, in order to create a multi-scaled approach to computer anomaly detection with automated response. By examining the time-average data from pH, we find the two systems to be conceptually complementary and to have compatible data models. Based on these findings, we build a simple prototype system and comment on how the same model could be extended to include other anomaly detection mechanisms.
doi:10.1007/978-0-387-35674-7_3 fatcat:q572lupwpzc37jghf3xgctjsqi