Intrusion Detection for Air Force Networks: Environment Forecast.

摘要

Will future intrusion detection tools meet the goals of the U.S. Air Force. To help ensure that they will, the MITRE C2 Protect Mission-Oriented Investigation and Experimentation (MOIE) project is forecasting the environment for Air Force intrusion detection. The forecast should be helpful to commercial interests that may develop capabilities, can be a means of coordinating and shaping future funding decisions, and may provide a common framework for discussing issues. The first phase of the MOIE project captured customer and corporate experience with intrusion detection tools as well as joint knowledge of the intrusion detection problem. The results are recorded in the paper 'Intrusion Detection for Air Force Networks: Operational, Performance, and Implementation Goals' (MTR-97B0000035). The second phase focuses on expected trends over the next several years that might affect the use, design, efficacy, deployment, or maintenance of intrusion detection tools within the Air Force. This paper, a product of the second phase of effort, records trend information developed primarily from in-house technical expertise. The results of this task provide an information resource that will guide vendors developing intrusion detection products. assist the Air Force's participation in more global efforts, supplement the information used by Air Force mission area teams, help planning for acquisition and funding, and provide a common framework for addressing issues. The authors characterize the intrusion detection environment using the following classification as a guide: the User Domain, the Attacker Domain, the Defender Domain, and the Technology Domain.