Appendix C: Intrusion Detection Glossary

[A]

Active Attack

An attack that results in an unauthorized state change, such as the manipulation of files or the adding of unauthorized files.

Administrative Security

The management constraints and supplemental controls established to provide an acceptable level of protection for data.

AIS

Automated Information System any equipment of an interconnected system or subsystem that is used in the automatic acquisition, storage, manipulation, control, display, transmission, or reception of data; includes software, firmware, and hardware,

Alert

A formatted message describing a circumstance relevant to network security. Alerts are often derived from critical audit events.

Ankle-Biter

A person who aspires to be a hacker/cracker, but has very limited knowledge or skills related to AISs; usually associated with young teens who collect and use simple malicious programs obtained from the Internet.

Anomaly Detection Model

A model where intrusions are detected by looking for activity that is different from the user's or system's normal behavior.

Application Level Gateway

A firewall system in which service is provided by processes that maintain complete TCP connection state and sequencing. Application level firewalls often re-address traffic so that outgoing traffic appears to have originated from the firewall, rather than the internal host.

ASIM

Automated Security Incident Measurement Monitors network traffic and collects information on targeted unit networks by detecting unauthorized network activity.

Assessment

Surveys and inspections; an analysis of the vulnerabilities of an AIS. An information acquisition and review process designed to assist a customer in determining how best to use resources to protect...