Concurrent Memory Inspection for Intrusion Detection
Christos V. Tsopokis · 2014
Data communication devices and services are of rising importance and vitally rely on intrusion detection infrastructure. Such systems are common target for cyber-criminals who employ novel attack vectors through exploitation and concealment methods. In this context we should include the evolution of hardware which makes multi-core/multi-processor systems rather ubiquitous. Unmasking techniques based on specification (e.g. signature-matching) are not capable of leading us a step after the attackers. Furthermore, concurrent systems are characterized by a non-deterministic scheduling behaviour that nullifies their static properties, thus making statistical analysis and machine learning rather difficult. Consequently, modern intrusion detection systems face various logic and physical challenges. To reveal this kind of activities, on-the-fly energetic data probing is necessary. is is because we care both for the dynamic attitude of the analysis and the detection speed. In addition such systems – be it behavioral or anomaly-based – should also tackle the well known problem of performance degradation on the target host. is project seizes upon the idea of anomaly-based host intrusion detection on distributed systems, with respect to the aspects mentioned above. Our main purpose is to explore the workability of such schemes and give a descent overview of the capabilities and limitations faces in this field. is is done by investigating potential sensor models based both on localization and outsourcing. Along with every model we investigate what shortcomings are faced, the performance impact and we try to enumerate all the factors that strike a balance between security, performance and convinience. We provide all the background needed for formulating legal states, concurrently extracting data and investigating their deviation from well-known trusted stati. is project works as a feasibility analysis of anomaly detectors on parallel systems and as such it focuses on providing an overview of the challenges and promises offered by such a system. ematerial provided is open to updates since it is affected by a number of factors that affect numerous assumptions.