SID (Space Intrusion Detection)

Heinrich Elsigan

September 2026

Download pdf   LaTeX

Introduction

SID is a concept for an intrusion detection system for linux servers in internet or local network including cloud linux servers,

1. SID daily monitors (and highlights changes to yesterday)

   • all mounted data file systems in detail (except log files, caches, /var/sppol/*)

   • installed kernel, kernel modules lsmod, kernel config and boot (initrd image)

   • current kernel and system settings (/proc file system)

   • attached and registered devices

   • network interfaces and netfilter iptables ip6tables rules

   • all running daemons especially those who allocate listening network tcp/udp socket descriptors

2. SID hourly monitors

   • available free disk space

   • load average

   • currently active users and daemons

   • all system inter-process communications ipcs lsipc

   • all file descriptors, locks, ... lsfd lslocks,

   • ...

3. SID permanently monitors

   • successful and failed authentications

   • errors with hints of critical intrusion in all logfiles

   • heavy process or CPU load, which could be an internal privilege escalation or brute force attack

…

Prequel

In UFO TV Series 1970s a SID Space Intrusion Detection, that scans permanently for unidentified flight objects, detects and tracks them and probabilistic calculates most possible ufo’s attack vectors. Ufo series intro & outro

UFO series: SID Space Intrusion Detection

Actions

Regular monitoring activities

SID writes a daily report and highlites all changes to yesterday. filesystem files changed content (sha512), special permissions and all filesystem date time entry changes are emphasized too.

When a concern or intrusion rule matches at daily changes, SID sends additionally an email or SMS. (We don’t want to have too many SPAMs for sysadmin / manager like in Nagios.) Nevertheless SID should send a weekly or montly ’all well and alive’ email message, so that you know, that SID is still operating.

YELLOW and RED alerts intrusion triggers

SID sends immediate an email / sms or Endpoint Service message in case of yellow / red alert at intrusion detection.

… …

SID protection

SID binaries are launched from a readonly not modifyable squash fs mounted image e.g. by snapcraft, a hardware protected usb stick, a LUKS encrypted readonly mounted filesystem or cd / dvd. SID config files should also only mounted rw, when changing them. SID reports could be signed, symmetric or asymmetric encrypted (with passwd or key or X509 certificate).

… …

Epilog

Good luck!

We hope you find SID useful and good luck. To contact me, use the contacts at https://heinrichelsigan.area23.at.