RE: firewalls and the incoming traffic problem

[Phil Cox <pcc () llnl gov>]

At 12:15 PM 9/30/97 -0700, you wrote:

[removed comments]

> respond to the attack is often limited. For ID techniques to work well in a
> living breathing network, I believe we will see intrusion detection spread
> out through the network, with the firewall being one of the many points of
> input. Just as the firewall policy should be that which is not specifically
> accepted is denied, IDS should learn by that model.

What is the thought on the ability to write a firewall specific IDS which
would use some type of meta language to define what was considered
"acceptable" for different services coming across a firewall. The the IDS
would flag or detect patterns which were considered normal or approved, and
the rest would be "problems" by default. This would give you the
"minimalist" stance in ID as well. 

Thoughts and comments.

Phil