IS THIS INTRUSION DETECTION?

• Discover attempts at break-in by packet monitoring



• Checking logs for strange behaviour



• This can be ONE element of an immune system



• We need not only to detect but to REACT



• Detection: lysis/necrosis or apoptosis