Search

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2006.09.011 Byline: Paul D. Williams, Eugene H. Spafford Keywords: Intrusion detection; Information system security; Co-processor; Multi-processor; Security policy compliance monitoring Abstract: The Co-Processing Intrusion Detection System (CuPIDS) project explores improving information system security through dedicating computational resources to system security tasks in a shared resource, multi-processor (MP) architecture. Our research explores ways in which this architecture offers improvements over the traditional uni-processor (UP) model of security. One approach we examined has a protected application running on one processor in a symmetric multi-processing (SMP) system while a shadow process specific to that application runs on a different processor. The shadow process monitors the application process' activity, ready to respond immediately if the application violates policy. Experiments with a prototype CuPIDS system demonstrate the feasibility of this approach in the context of a self-protecting and self-healing system. An untuned prototype supporting fine-grained protection of the real-world application WU-FTP resulted in less than a 15% slowdown while demonstrating CuPIDS' ability to quickly detect illegitimate behavior, raise an alarm, automatically repair the damage done by the fault or attack, allow the application to resume execution, and export a signature for the activity leading up to the error. Author Affiliation: Air Force Institute of Technology, Wright-Patterson Air Force Base, Department of Electrical and Computer Engineering, OH, United States CERIAS, Purdue University, West Lafayette, IN, United States Article Note: (footnote) [star] The opinions expressed in this paper are those of the authors, and do not necessarily reflect the views of the US Air Force, or the US Government.

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2006.09.006 Byline: Yu-Sung Wu (a), Bingrui Foo (a), Yu-Chun Mao (a), Saurabh Bagchi (a), Eugene H. Spafford (a)(b) Keywords: Automated adaptive intrusion response; Intrusion containment; E-commerce system; Survivability; Attack graphs Abstract: Large scale distributed systems typically have interactions among different services that create an avenue for propagation of a failure from one service to another. The failures being considered may be the result of natural failures or malicious activity, collectively called disruptions. To make these systems tolerant to failures it is necessary to contain the spread of the occurrence automatically once it is detected. The objective is to allow certain parts of the system to continue to provide partial functionality in the system in the face of failures. Real world situations impose several constraints on the design of such a disruption tolerant system of which we consider the following - the alarms may have type I or type II errors; it may not be possible to change the service itself even though the interaction may be changed; attacks may use steps that are not anticipated a priori; and there may be bursts of concurrent alarms. We present the design and implementation of a system named Adepts as the realization of such a disruption tolerant system. Adepts uses a directed graph representation to model the spread of the failure through the system, presents algorithms for determining appropriate responses and monitoring their effectiveness, and quantifies the effect of disruptions through a high level survivability metric. Adepts is demonstrated on a real e-commerce testbed with actual attack patterns injected into it. Author Affiliation: (a) Dependable Computing System Lab (DCSL) and CERIAS, School of Electrical and Computer Engineering, Purdue University, 465 Northwestern Avenue, West Lafayette, IN 47907, United States (b) School of Computer Science, Purdue University, 250 N. University Street, West Lafayette, IN 47907-2066, United States