The Common Intrusion Specification Language: a retrospective

The Common Intrusion Detection Framework (CIDF) has as its main goal the development of a means whereby independently developed intrusion detection, analysis and response systems and components can share information and thereby interoperate. The main product of CIDF is the Common Intrusion Specification Language (CISL), in which expressions about attacks, anomalies and response prescriptions can be generated and encoded. In this paper, we discuss the development and structure of the language.