Towards the attack signatures' comparison in survivable computer networks

Survivability architecture and run-time attack detection can be successfully implemented based on attack signatures. In this paper, the authors concentrate on profile signatures based on Markov models. They are represented by the frequency spectrum of the functionalities in the system. The difference between safe system signatures from attacked (monitored) system signatures indicates possible intrusion. This paper proposes an approach, based on soft computing techniques, for recognizing that difference.