In Information security, Intruder Detection is the art of detecting intruders behind attacks as unique persons. This techniques try to identify the person analyzing their computational behaviour.

This concept is not yet very extended and tend to be confused with Intrusion_Detection (also known as IDS) techniques which are the art of detecting intruder actions.

Theory

Intruder Detection Systems (See Intruder detection#Translation Confusion) try to detect whom is attacking a system analyzing his computational behaviour or biometric behaviour.

Some of the parameters used to identify a person

Keystroke Dynamics (aka:Keystroke Patterns Typing Pattern, Typing Behaviour)
Patterns using an interactive command interperter:
- Commands Used.
- Commands Sequence.
- Accessed Directories.
- Caracter deletion.
Patterns on the network usage:
- Ip address used
  - ISP
  - Country
  - City
- Ports Used.
- TTL analysis.
- Operation System used to attack. See p0f.
- Protocols Used.
- Connection Times Patterns.

Keystroke Dynamics

Keystroke Dynamics is paramount in Intruder Detection techniques because is the only parameter that has been classified as real 'behavioural biometric pattern'.

Keystroke Dynamics analyze times between keystrokes issued in a computer keyboard or celular phone keypad searching for patterns. First techniques used Statistics and Probability concepts like 'standard deviations' and 'Mean', later approaches use Data mining, Neural Networks, Support Vector Machines, etc.

There are a huge amount of papers on this topic.

History

Some other earlier works reference the concept of Intruder Autentication, Intruder Verification, or Intruder Clasification, but in its full meaning, the Si6 proyect Si6#Paranoid was one of the first proyects to research about it.

Translation Confusion

There is a confusion with the spanish translation of 'Intruder Detection Systems', some people translate it as 'Sistemas de Detección de Intrusiones', but others translate it as 'Sistemas de Detección de Intrusos'. Ony the former is correct.

External Links

This computing article is a stub. You can help Wikipedia by expanding it.