General statement

The DICO project is a common research effort between LSV/CNRS UMR 8643 & ENS Cachan, NetSecure Software, France Télécom R&D, the IRISA/INSA LANDE project, SupElec Rennes, ONERA DTIM, and IRIT.

It is funded by a 2-year French national programme, the "Réseau National des Technologies Logicielles", in short the RNTL, sponsored by the French ministries of industry and of research and technology. The DICO project started in December 2001.

DICO is a project on intrusion detection, which puts the stress on complex intrusion detection, and correlation at different levels: correlation of individual events to form composite events and report alerts, and correlation of alerts by cooperating intrusion detection tools.

This Web page is only intended to give information on the various contributions of the LSV to the project. The general page for the DICO project is here. The "fiche résumé" that introduces the goals and perspectives of the DICO project is here.

Current implementations and documentation

• The LogWeaver intrusion detection tool is based on efficient online model-checking algorithms; its purpose is to detect temporally related events in log files and report them. A tutorial is available here (in Postscript or PDF). LogWeaver was developed in part as part of the Dyade VIP project.
• The current evaluation version, in a compressed tar archive. You may also look directly into the LogWeaver evaluation distribution directory. This only contains the logw binary for Linux (with glibc) together with example files as used in the documentation. See file COPYING for terms.
• The LSV is leader of subproject 3: languages for signatures and attack scenarios.

  Here is the current version (in ps or in pdf) of the first deliverable at T0+6. The full distribution is available as a compressed tarball, or in the directory tree.

  Here is the second deliverable at T0+18, in compressed Postscript; in French.

• The jtg (Junk Traffic Generator) tool, a tool to insert sequences of events at random, for testing IDSes. Distribution is in compressed tar form, or here is the directory.
• The evtgen tool, which generates sequences of events of random, for testing IDSes. Distribution is in compressed tar form, or here is the directory.