Search

This paper presents first theoretical model of IDPS which combines application tracing and user decisions for building user profiles. This novel idea is based on fact that we have seen nearly all kind of malware since Intrusion Detection System was widely deployed. Our solution presents “deny any” policy as default action. Thus all behavior that we have not seen before is considered as malicious. This paper presents several novel approaches, such as building four various databases used for software description and one profile database for describing user behavior, opposite existing solutions which mainly uses just one database for specifying malware. Presented architecture of this approach outlines predispositions to use this solution with crowd sourcing.