\documentclass{article}

\usepackage[english]{babel}
\usepackage[letterpaper,top=2cm,bottom=2cm,left=3cm,right=3cm,marginparwidth=1.75cm]{geometry}
% Useful packages
\usepackage{amsmath}
\usepackage{graphicx}
\usepackage[colorlinks=true,linkcolor=blue,urlcolor=blue]{hyperref}
\usepackage{xcolor}
\usepackage{color}
\usepackage[T1]{fontenc}
\usepackage{geometry}
\usepackage{hyperref}
\usepackage{makeidx}
\usepackage{amssymb}
\usepackage{alltt}
\usepackage{graphicx}
\usepackage{layout}
\usepackage{fancyhdr}
\usepackage{float}


\title{SID (Space Intrusion Detection)}
\author{Heinrich Elsigan}
\date{September 2026}

\begin{document}

\maketitle

\tableofcontents

\pagebreak

\section{Introduction}

SID is a concept for an intrusion detection system for linux servers in internet or local network including cloud linux servers,
 
\begin{enumerate}
    \item SID daily monitors (and highlights changes to yesterday)
    \begin{itemize}
    \item all mounted data filesystems in detail (except log files, caches, /var/sppol/*)
    \item installed kernel, kernel modules lsmod, kernel config and boot ( initrd image
    \item current kernel and system settings (/proc fs)
    \item attached and registered devices
    \item network interfaces and netfilter iptables ip6tables rules
    \item all running daemons especially those who allocate listening network  tcp/udp socket descriptors
    \end{itemize}
    \item SID hourly monitors 
    \begin{itemize}
    \item available free disk space
    \item load average
    \item currently active users and daemons
    \item all system inter-process communications ipcs lsipc
    \item all file descriptors, locks, ... lsfd lslocks,
    \item ...
    \end{itemize}
    \item SID permanently monitors  
    \begin{itemize}
    \item successful and failed authentications 
    \item errors with hints of critical intrusion in all logfies 
    \item heavy process or cpu load, which could be an internal privilege escalation or brute force attack
    \end{itemize}
\end{enumerate}

\dots
    
\subsection{Prequel}
In \href{https://en.wikipedia.org/wiki/UFO_(British_TV_series)}{UFO TV Series} 1970s a \href{https://ufoseries.com/guide/sid.html}{SID Space Intrusion Detection}, that scans permanently for unidentified flight objects, detects and tracks them and probabilistic calculates most possible ufo's attack vectors.
\href{https://www.youtube.com/watch?v=1qDy4OMAkgY}{Ufo series intro & outro}


\begin{figure}
    \centering
    \includegraphics[width=0.5\linewidth]{sid.jpg}
    \caption{UFO series: SID Space Intrusion Detection}
    \label{fig:placeholder}
\end{figure}

\pagebreak

\section{Actions}

\subsection{Regular monitoring activities}

SID writes a daily report and highlites all changes to yesterday.
filesystem files changed content (sha512), special permissions and all filesystem date time entry changes are emphasized too.

When a concern or intrusion rule matches at daily changes, 
SID sends additionally an email or SMS.
(We don't want to have too many SPAMs for sysadmin / manager like in Nagios.)
Nevertheless SID should send a weekly or montly 'all well and alive' email message, so that you know, that SID is still operating.

\subsection{YELLOW and RED alerts intrusion triggers}

SID sends immediate an email / sms or Endpoint Service message in case of yellow / red alert at intrusion detection.


\dots
\dots

\section{SID protection}

SID binaries are launched from a readonly not modifyable squash fs mounted image e.g. by snapcraft, a hardware protected usb stick, a LUKS encrypted readonly mounted filesystem or cd / dvd.
SID config files should also only mounted rw, when changing them.
SID reports could be signed, symmetric or asymmetric encrypted (with passwd or key or X509 certificate).


\dots
\dots

\pagebreak

\section{Epilog}

\subsection{Good luck!}

We hope you find SID useful and good luck.
To contact me, use the contacts at \url{https://heinrichelsigan.area23.at}.

\begin{abstract}

Hi, I’m \href{https://heinrichelsigan.area23.at/}{Heinrich Elsigan}
I am interested in C\#, Java, MSSQL, .Net Core, Android and politics, society and the future;
currently working as freelancer (one person company) and planning a secure endpoint 2 endpoint chat and looking to collaborate on reviews for other repositories and projects. Article written in \LaTeX{}.

\begin{enumerate}
    \item personal tech and political blog \href{https://area23-at.blogspot.com/}{blog.area23.at}
	\item GitHub repositories \href{https://github.com/heinrichelsigan}{github.com/heinrichelsigan/}
	\item StackOverflow \href{https://stackoverflow.com/users/12213151/heinrich-elsigan?tab=profile}{stackoverflow.com/users/12213151/heinrich-elsigan}
    \item Curriculum vitae \href{https://heinrichelsigan.area23.at/cv}{heinrichelsigan.area23.at/cv}
    \item live demo .Net \href{https://area23.at/net/}{area23.at/net}		
\end{enumerate}

\end{abstract}


\bibliographystyle{alpha}
\bibliography{sample}

\end{document}