Privacy-Respecting Intrusion Detection (2007)

Intrusion detection systems (IDS) monitor computer systems, record audit data and analyze the collected data in order to detect misuse. The recorded audit data documents user behavior and contains personal data of system users. As a result, collecting and processing audit data for misuse detection conflicts with pertinent privacy law. Privacy-Respecting Intrusion Detection introduces the concept of technical purpose binding, which restricts the linkability of pseudonyms in audit data to the amount necessary for misuse detection. Also, it limits the recovery of personal data to pseudonyms involved in a detected misuse scenario. The book includes case studies demonstrating this theory, and solutions that are constructively validated by providing algorithms.