Global intrusion detection and tolerance in networked systems

ABSTRACT

This paper presents an architecture for a global intrusion detection and tolerance such as global detection, global correlation, and intrusion tolerance. Global Intrusion Detection and Tolerance System (GIDTS). The cooperation proposed by the GIDTS solution allows the detection of complex attacks at their early stages. This cooperation is performed based on the output of several detection components located at different levels (wire network, wireless network, host, and disk). In addition, major detection and tolerance capabilities are protected against intruders attempts since they are performed by compromise independent components, located at the disk level. The GIDTS components implement different functions based on formal models proposed in this paper including, especially, alert correlation, storage requests, and tolerance strategy models. To enhance detection and tolerance capabilities, each GIDTS is assumed to cooperate with any other GIDTSs via a neighbor identification protocol. To illustrate GIDTS behavior, we propose an environment that integrates the flight management system, which represents a distributed application.

REFERENCES

• 1: C. J. Healey: P. Ning: D. Xu; and R. St. Amant, Building attack scenarios through integration of complementary alert correlation method, CIT05 (USA), 2004.
• 2: Y. Djemail; S. Rekhis; and N. Boudriga, Cooperative intrusion detection and tolerance system, ICECS, 2005.
• 3: Samuel T. King , Peter M. Chen, Backtracking intrusions, ACM Transactions on Computer Systems (TOCS), v.23 n.1, p.51-76, February 2005 [doi>10.1145/1047915.1047918]
• 4: Vipin Kumar, Parallel and Distributed Computing for Cybersecurity, IEEE Distributed Systems Online, v.6 n.10, p.1, October 2005 [doi>10.1109/MDSO.2005.53]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Algorithms, Security

Keywords:
disk-based intrusion detection, distributed attacks, global detection, local detection, tolerance