On preventing intrusions by process behavior monitoring

摘要: Society's increasing reliance on networked information systems to support critical infrastructures has prompted interest in making the survivable, so that they continue perform functions even presence of vulnerabilities susceptible malicious attacks. To enable vulnerable survive attacks, it is necessary detect attacks and isolate failures resulting from before damage system by impacting functionality, performance or security. The key research problems this context include: • detecting in-progress cause damage, as opposed after have succeeded, localizing and/or minimizing isolating attacked components real-time, tracing origin attacks. We address detection problem real-time event monitoring comparison against events known be unacceptable. Real-time differentiates our approach previous works focus intrusion post-attack evidence analysis. We isolation supporting automatic initiation reactions. Reactions are programs we develop respond A reaction's primary goal compromised prevent them damaging other components. secondary aid attack, e.g., providing an illusion success attackers (enticing attack) while ensuring attack causes no damage. Our based specifying permissible process behaviors logical assertions sequences calls conditions values call arguments. compile specifications into finite state automata for efficient runtime deviations specified (and hence permissible) behavior. seamlessly integrate reaction designing specification language also allow