Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection

Résumé

As distributed computations become more and more common in highly distributed environments like the cloud, intrusion detection systems have to follow these paradigms. Anomaly based intrusion detection systems in distributed sys- tems usually rely on a total order of the observed events. However, such hypothesis is often too strong, as in a highly distributed environment the order of the observed events is partially unknown. This paper demonstrates it is possible to infer a distributed application behavior model for intrusion detection, relying only on event partial ordering. The originality of the proposed approach is to tackle the problem by combining two types of models that are usually used separately: an automaton modeling the distributed computation, and a list of temporal properties that the computation must comply with. Finally, we apply the approach on two examples, and assess the method on a real distributed application.
Fichier non déposé

Dates et versions

hal-01334596 , version 1 (21-06-2016)

Identifiants

Citer

Eric Totel, Mouna Hkimi, Michel Hurfin, Mourad Leslous, Yvan Labiche. Inferring a Distributed Application Behavior Model for Anomaly Based Intrusion Detection. 12th European Dependable Computing Conference, Sep 2016, Gothenburg, Sweden. ⟨10.1109/edcc.2016.13⟩. ⟨hal-01334596⟩
300 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More