RETISS: a real time security system for threat detection using fuzzy logic

A real-time security system (RETISS) for threat detection is described, pointing out security violations in the target system under control. RETISS is based on the hypothesis that a correlation exists between anomalous user behavior and threats. Security rules have been enforced to express this correlation and to detect and evaluate the probability of a given threat, based on the level of danger of the occurrences of the anomalies symptomatic for the threat. Levels of danger of all the anomalies are then fuzzy combined to express the probability of the threat. RETISS is independent of any particular system and application environment. Moreover, RETISS runs on a machine different from that of the target system in order to be protected against attacks from users of the target system