Design and Implementation of an Open Signature Database for Network Attack
For the globalization of network attack, intrusion detection systems (IDS) should protect not only a local sub-net, but the whole network environment. Therefore, an urgent requirement of open resources for intrusion detection is coming to being. An open signature database for IDS has been implemented in the effort of this paper, which includes more than 1200 effective signatures. In this paper, the Intrusion Signature Exchange Protocol (ISEP) is presented, which has been used by IDSes to update signatures from the database in real time. Digital certificate and role-based access control technique involved in the system is described. Finally, in the case study of Nachi worm, the method of signature extraction is illustrated.