Architecture of Computer Intrusion Detection Based on Partially Ordered Events
Liberios Vokorokos, Anton Baláž · InTech eBooks · 2010
Information technology security nowadays presents one of the main priorities of modern society dependent on information. Protection of data access, availability, and integrity represents basic security properties insisted on information sources. Intrusion of one of the properties mentioned above may form penetration or attack on the computer system. Within protection mechanisms, various methods providing security rules relating individual levels of possible behavior are classified. Other protection mechanisms are diversified systems detecting suspicious behavior. Intrusion detection systems belong to these systems as well. One of the main problems of intrusion detection is potential attack variability. From the detection perspective, generation of exact intrusion attribute sequence is deficient. The property of attack sequence non-determination is not be described by the entire sequence of events forming intrusion. One of the goals of this work was to solve attack variability mentioned above. Upon attribute properties and their context research, classificatory hierarchy describing mutual references within attributes and events was formed. Analysis result is a new method of penetration representation in form of partially-ordered events scheme enabling generation of some dependencies only, within the whole set of events describing intrusion. The resultant event scheme is transformed into Petri Nets that evaluate input event flow and detect possible attributes of represented intrusions. The aim of this work was to introduce designed intrusion detection architecture based on partially-ordered events and patterns. The main work goal was production of intrusion detection and its alternatives method. Produced method identities possible system intrusions by means of monitoring computer system state patterns. Individual states of the monitoring system are described through performed events, and individual dependencies within the performed events. The resultant detection model is realized by the Petri Nets. Upon designed IDS system architecture, system prototype was implemented and tested. From test results, functionality and practical usability of designed IDS architecture is resulted. From experimentation conclusions, interactivity of central processing unit CPU and memory subsystem is the determining factor with influence on entire intrusion detection effectiveness. The resultant system represents live system with possibility of dynamic addition and removal of other detected intrusions. The work is one of reached results within projects VEGA 1/4071/07 (Security architecture of heterogeneous distributed and parallel computing system and dynamical computing system resistant against attacks), and APVV 0073-07 (Identification methods and analysis of safety threats in architecture of distributed computer systems and dynamical networks) being solved at Department of Computers and Informatics, Faculty of Electrical Engineering and Informatics, Technical University of Kosice.