METHOD AND SYSTEM FOR DETECTING INTRUSION IN NETWORKS AND SYSTEMS BASED ON BUSINESS-PROCESS SPECIFICATION

摘要

Intrusions and incidents on networks and systems are detected using intrusion detection systems. The present invention relates to the field of security in communication networks, control systems and information systems and concerns an intrusion detection system and method based on the specification of business processes and business rules. Different methods are implemented to use events in each system or network as indicators of actions on the systems involved, and these are analyzed to determine whether they correspond to a previously specified business process being run, an alarm being triggered if they do not. The present invention considerably reduces the number of false positives typical in intrusion detection systems, and are particularly useful for protecting systems involved in business processes that can be fully specified, notably industrial systems and systems used in critical infrastructure.