Abstract
Computer security systems protect computers and networks
from unauthorized use by external agents and insiders.
The similarities between computer security and the
problem of protecting a body against damage from externally
and internally generated threats are compelling and
were recognized as early as 1972 when the term computer
virus was coined. The connection to immunology was made
explicit in the mid 1990s, leading to a variety of prototypes,
commercial products, attacks, and analyses. The paper reviews
one thread of this active research area, focusing on
system-call monitoring and its application to anomaly intrusion
detection and response.