Using Constraints for Intrusion Detection: The NeMODe System - Salgueiro, Pedro (2012)
In this work we present NeMODe a declarative system for Computer Network Intrusion detection which provides a declarative Do- main Specific Language for describing computer network intrusion signa- tures that could spread across several network packets, which allows to state constraints over network packets, describing relations between sev- eral packets, and providing several back-end detection mechanisms which relies on Constraint Programming (CP) methodologies to find those in- trusions.