Intrusion detection in data processing systems

• US 20020194469A1
• Filed: 05/17/2002
• Published: 12/19/2002
• Est. Priority Date: 06/14/2001
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Riordan, James F., Wespi, Andreas, Dominique, Alessandri
• Granted Patent: US 7,568,228 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Described is apparatus for testing an intrusion detection system in a data processing system. The apparatus comprises an attack generator for generating attack traffic on a communications path in the data processing system. A collector receives responses generated by the intrusion detection system on receipt of the attack traffic. A controller coupled to the attack generator and the collector varies the attack traffic generated by the attack generator in dependence on the response received from the intrusion detection system by the collector.

Claims

1. Apparatus for testing an intrusion detection system in a data processing system, the apparatus comprising:

an attack generator for generating attack traffic on a communications path in the data processing system;

a collector for receiving responses generated by the intrusion detection system on receipt of the attack traffic; and

, a controller coupled to the attack generator and the collector for varying the attack traffic generated by the attack generator in dependence on the response received from the intrusion detection system by the collector.

2. Apparatus as claimed in claim 1, further comprising a traffic generator for generating background traffic on the communications path.

3. Apparatus as claimed in claim 2, wherein the controller is connected to the traffic generator for varying the background traffic generated by the traffic generator in dependence on the response received from the intrusion detection system.

4. Apparatus as claimed in any preceding claim, wherein the attack generator comprises:

an attack tool for generating the attack traffic;

a plurality of logical layers disposed between the attack tool and the communication path for communicating the attack traffic from the attack tool to the communications path, each logical layer having a control interface for receiving attack variation data; and

control logic connected to the controller for sending attack variation data to the logical layers via the control logic to vary the attack traffic based on control data, the attack variation data being generated by the control logic in dependence on the response received from the intrusion detection system by the collector.

5. Apparatus as claimed in any preceding claim wherein the communications path comprises a bus subsystem.

6. Apparatus as claimed in any claim preceding claim 5 wherein the communication path comprises a network.

9. A method as claimed in claim 5, comprising generating by a traffic generator background traffic on the communication path.

10. A method as claimed in claim 6, comprising varying the background traffic generated by the traffic generator in dependence on the response received from the intrusion detection system.

11. A computer program element comprising computer program code means which, when loaded in a processor of a data processing system having an intrusion detection system configures the processor to perform a method as claimed in any of claims 5 to 7.

8. A method for testing an intrusion detection system in a data processing system, the method comprising:

generating by an attack generator attack traffic in a communications path in the data processing system;

receiving by a collector responses from the intrusion detection system to the attack traffic generated by the attack generator; and

, varying by a controller coupled to the attack generator and the collector the attack traffic generated by the attack generator in dependence on the response received by the collector from the intrusion detection system.

12. A data processing system comprising a processor, a memory, a bus subsystem interconnecting the memory and processor, and a computer program element as claimed in claim 8 stored in the memory.