A Novel Algorithm for Intrusion Detection Based on RASL Model Checking

Table 1

The way of constructing models for attacks: behaviors and their RASL formulas.

Attack behaviors	RASL formulas defined for description of behaviors
𝑎𝑗 means an atomic action	A state formula 𝑤𝑗
𝐴𝑖=𝑎1,…,𝑎𝑚 means a phase in an attack	𝜑𝑖=((𝑤1∧𝑠𝑘𝑖𝑝);𝑡𝑟𝑢𝑒);…;((𝑤𝑚∧𝑠𝑘𝑖𝑝);𝑡𝑟𝑢𝑒)
𝑎=𝐴1,…,𝐴𝑛 means an attack	𝜑=(𝜑1∧𝑠𝑘𝑖𝑝);𝑡𝑟𝑢𝑒;…;(𝜑𝑛∧𝑠𝑘𝑖𝑝);𝑡𝑟𝑢𝑒
𝑎𝑗 is repeated 𝑘 times	𝜑=𝑙𝑒𝑛(𝑘)∧𝑤𝑗∧𝑠𝑘𝑖𝑝^∗
𝐴𝑖 is repeated 𝑘 times	𝜑=((𝜑𝑖∧𝑠𝑘𝑖𝑝)^Θ,𝑏)𝑝𝑟𝑗((𝑡𝑟𝑢𝑒∧𝑠𝑘𝑖𝑝^∗∧𝑙𝑒𝑛(𝑘+1);𝑐))∧□(𝑏↔𝑐)
Result of 𝑎𝑗 is 𝑡𝑓𝑗, 𝑡𝑓𝑗∈{𝑓𝑎𝑖𝑙,𝑠𝑢𝑐𝑐𝑒𝑠𝑠}	𝜑=(𝑤𝑗∧𝑒𝑚𝑝𝑡𝑦)𝑝𝑟𝑗𝑡𝑓𝑗
𝑎=𝐴1,…,𝐴𝑛, where result of 𝐴𝑖 is 𝑡𝑓𝑖	𝜑=𝜑1∧𝑠𝑘𝑖𝑝;𝑡𝑟𝑢𝑒,…,𝜑𝑛∧𝑠𝑘𝑖𝑝;𝑡𝑟𝑢𝑒𝑝𝑟𝑗(𝑡𝑓1∧○𝑡𝑓2∧…∧○^𝑛−1𝑡𝑓𝑛)
𝑎=𝐴1|…|𝐴𝑛	𝜑=𝜑1‖…‖𝜑𝑛
𝐴1 and 𝐴2 are two ways of the attack	𝜑=𝜑1∨𝜑2
Time constraint between 𝐴𝑖 and 𝐴𝑖+1 is 𝐼𝑖	𝜑=𝜑1;𝐼1…;𝐼𝑛−1𝜑𝑛