Title

Beyond Output Voting: Detecting Compromised Replicas Using HMM-based Behavioral Distance

Publication Type

Journal Article

Publication Date

4-2009

Abstract

Many host-based anomaly detection techniques have been proposed to detect code-injection attacks on servers. The vast majority, however, are susceptible to "mimicry" attacks in which the injected code masquerades as the original server software, including returning the correct service responses, while conducting its attack. "Behavioral distance," by which two diverse replicas processing the same inputs are continually monitored to detect divergence in their low-level (system-call) behaviors and hence potentially the compromise of one of them, has been proposed for detecting mimicry attacks. In this paper, we present a novel approach to behavioral distance measurement using a new type of hidden Markov model, and present an architecture realizing this new approach. We evaluate the detection capability of this approach using synthetic workloads and recorded workloads of production Web and game servers, and show that it detects intrusions with substantially greater accuracy than a prior proposal on measuring behavioral distance. We also detail the design and implementation of a new architecture, which takes advantage of virtualization to measure behavioral distance. We apply our architecture to implement intrusion-tolerant Web and game servers, and through trace-driven simulations demonstrate that it experiences moderate performance costs even when thresholds are set to detect stealthy mimicry attacks.

Keywords

Fault-tolerance, Information flow controls, Intrusion detection, Measurements, Network-level security and protection, Performance measures, Protection mechanisms, Reliability, Security, Unauthorized access (hacking, Web server, and serviceability, availability, behavioral distance., output voting, phreaking), replicated system, system call

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

IEEE Transactions on Dependable and Secure Computing

Volume

6

Issue

2

First Page

96

Last Page

110

ISSN

1545-5971

Identifier

10.1109/TDSC.2008.39

Publisher

IEEE

Additional URL

http://dx.doi.org/10.1109/TDSC.2008.39