FAU_SAA.3 Simple attack heuristics
Hierarchical to: FAU_SAA.1 Potential violation analysis
FAU_SAA.3.1 The TSF shall be able to maintain an internal representation of the following signature events [assignment: a subset of system events] that may indicate a violation of the TSP.
FAU_SAA.3.2 The TSF shall be able to compare the signature events against the record of system activity discernible from an examination of [assignment: the information to be used to determine system activity].
FAU_SAA.3.3 The TSF shall be able to indicate an imminent violation of the TSP when a system event is found to match a signature event that indicates a potential violation of the TSP.
Dependencies: No dependencies.