Contents

• Introduction
  • Problem setting - untrusted code
• The Security Assistant
  • Why use a Security Assistant?
  • Envisioned use
    • Categories describing behavior
    • Conceived example -- Detecting malicious behavior
  • Security Implications
  • Envisioned architecture
    • Suggested architecture
• External Issues -- Design and Implementation
  • Environment
    • Subversion - How to protect the assistant and encapsulate the programs
    • Identity - How to distinguish the programs
    • Granularity - What data can be gathered.
    • Acquisition - What methods are there to extract audit data.
  • Operation
    • Interception - reactive or immediate
    • Efficiency.
• Internal Issues -- Design and Implementation
  • Sensors
  • What to monitor, When to signal.
  • Adding/Removing sensors.
  • Combination of sensors.
• Related work -- Safe languages
  • What is a safe language?
  • Restricted access
  • Analyzing code
  • Other computational models
• Related work -- Intrusion detection
  • What are intrusion Detection Systems?
  • Approaches to Intrusion Detection Systems
    • Approaches to Statistical Change Detection
    • Rules
  • Related Projects
    • Crosbie
    • NIDES
    • GASSATA
    • Forrest
    • Ko-fink
    • Finjan
• Conclusions
• Prototypes
  • Java-prototype
  • Tcl-prototype
  • Prolog-prototype
  • Example Sensors
• References
• About this document ...