Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2016

Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection

Abstract

As distributed computations become more and more common in highly distributed environments like the cloud, intrusion detection systems have to follow these paradigms. Anomaly based intrusion detection systems in distributed sys- tems usually rely on a total order of the observed events. However, such hypothesis is often too strong, as in a highly distributed environment the order of the observed events is partially unknown. This paper demonstrates it is possible to infer a distributed application behavior model for intrusion detection, relying only on event partial ordering. The originality of the proposed approach is to tackle the problem by combining two types of models that are usually used separately: an automaton modeling the distributed computation, and a list of temporal properties that the computation must comply with. Finally, we apply the approach on two examples, and assess the method on a real distributed application.
No file

Dates and versions

hal-01334596 , version 1 (21-06-2016)

Identifiers

Cite

Eric Totel, Mouna Hkimi, Michel Hurfin, Mourad Leslous, Yvan Labiche. Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection. 12th European Dependable Computing Conference, Sep 2016, Gothenburg, Sweden. ⟨10.1109/edcc.2016.13⟩. ⟨hal-01334596⟩
298 View
0 Download

Altmetric

Share

Gmail Facebook X LinkedIn More