About the Intrusion Specification Language scope (fwd)

---------- Forwarded message ----------
Date: Fri, 21 Jun 2002 16:51:04 +0200 (CEST)
From: George B. Magklaras <[email protected]>
To: [email protected]
Subject: About the Intrusion Specification Language scope 

Hello,

I am a software engineer by profession and a part time researcher on 
Intrusion Detection Systems/ Insider IT misuse 
(http://ted.see.plym.ac.uk/nrg/scripts/showcurrentphd.asp?projectid=6).

I have been larking in this list for a long time now, watching the IDMEF 
proposals evolve. After reading carefully the relevant Internet Draft 
documents and considering the target work output of the IDWG, I have one 
fundamental question in relation to the group's target no. 2:

'2. A common intrusion language specification, which describes data 
formats that satisfy the requirements.'

I do understand that it is important to have a standard to facilitate 
data exchange amongst various IDS framework components and I agree that 
the inclusion of the IDMEF model, its association with XML and its 
implementation by Stuart Staniford in Silicon Defense address the listed 
requirements. However, (and always in my -probably restricted- view) I 
do not understand how the current IDWG's efforts address the fundamental 
problem of devising a standard way for describing the intrusion activity 
itself. What I am really talking talking about is more along the lines 
of the older 'Common Intrusion Specification Language (CISL)', (with 
reference to the last document revised on  11/06/1999 found in 
 http://www.isi.edu/gost/cidf/drafts/language.txt ). My understanding is 
that what originally constituted the Common Intrusion Detection 
Framework (CIDF) evolved (in terms of improving and expanding the 
message exchange format types and mechanisms) into the IDMEF and its 
associated tools. On the other hand, further research 
activities/comments  that concern the streamlining of the Semantic 
IDentifier expressions (SIDs), the tools that provide the foundations 
for expressing a series of intrusive activities using a semantic schema 
seem to be absent from the  IDWG documentation. The word language 
specification for me includes both the data format specification as well 
as the syntax. IDMEF defines extensively the first area whereas the 
latter issues seem to be addressed only by CISL.

If my thoughts are true, where does the current development of the CISL 
stand? Is the project still active with people trying to further 
refine/expand its SID base? Is the IDWG currently involved in this area 
and if yes, could you point to any documents that contain the latest 
advances/references.

On the other hand, if I have misunderstood the scope of the IDWG work in 
relation to the syntax features of an Intrusion Specification Language, 
I would very much appreciate your comments.

Thank you in anticipation, 

-- 
---
George B. Magklaras

Internet Consultant
Internet Services Group (ISG)
Video Networks Ltd. (UK)
Tel: +44 (0)1707 362500
Internal Extension: 2580