Publication Type
Journal Article
Version
acceptedVersion
Publication Date
4-2009
Abstract
Many host-based anomaly detection techniques have been proposed to detect code-injection attacks on servers. The vast majority, however, are susceptible to "mimicry" attacks in which the injected code masquerades as the original server software, including returning the correct service responses, while conducting its attack. "Behavioral distance," by which two diverse replicas processing the same inputs are continually monitored to detect divergence in their low-level (system-call) behaviors and hence potentially the compromise of one of them, has been proposed for detecting mimicry attacks. In this paper, we present a novel approach to behavioral distance measurement using a new type of hidden Markov model, and present an architecture realizing this new approach. We evaluate the detection capability of this approach using synthetic workloads and recorded workloads of production Web and game servers, and show that it detects intrusions with substantially greater accuracy than a prior proposal on measuring behavioral distance. We also detail the design and implementation of a new architecture, which takes advantage of virtualization to measure behavioral distance. We apply our architecture to implement intrusion-tolerant Web and game servers, and through trace-driven simulations demonstrate that it experiences moderate performance costs even when thresholds are set to detect stealthy mimicry attacks.
Keywords
Fault-tolerance, Information flow controls, Intrusion detection, Measurements, Network-level security and protection, Performance measures, Protection mechanisms, Reliability, Security, Unauthorized access (hacking, Web server, and serviceability, availability, behavioral distance., output voting, phreaking), replicated system, system call
Discipline
Information Security
Research Areas
Cybersecurity
Publication
IEEE Transactions on Dependable and Secure Computing
Volume
6
Issue
2
First Page
96
Last Page
110
ISSN
1545-5971
Identifier
10.1109/TDSC.2008.39
Publisher
IEEE
Citation
GAO, Debin; Reiter, Michael K.; and SONG, Dawn.
Beyond output voting: Detecting compromised replicas using HMM-based behavioral distance. (2009). IEEE Transactions on Dependable and Secure Computing. 6, (2), 96-110.
Available at: https://ink.library.smu.edu.sg/sis_research/765
Copyright Owner and License
Authors
Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.
Additional URL
https://doi.org/10.1109/TDSC.2008.39