Adaptable Intrusion Detection Systems Dedicated to Concurrent Programs: a Petri Net-Based Approach - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2010

Adaptable Intrusion Detection Systems Dedicated to Concurrent Programs: a Petri Net-Based Approach

Jean-Baptiste Voron
  • Fonction : Auteur
  • PersonId : 968352
Clément Démoulins
  • Fonction : Auteur
  • PersonId : 980147
Fabrice Kordon

Résumé

Intrusion detection systems (IDS) are one way to tackle the increasing number of attacks that exploit software vulnerabilities. However, the construction of such a security system is a delicate process involving: (i) the acquisition of the monitored program behavior and its storage in a compact way, (ii) the generation of a monitor detecting deviances in the program behavior. These problems are emphasized when dealing with complex or parallel programs. This paper presents a new approach to automatically generate a dedicated and customized IDS from C sources targeting multi-threaded programs. We use Petri Nets to benefit from a formal description able to compactly describe parallel behaviors. Obtained models can then be enhanced with extra requirements such as resources usage limits or temporal execution bounds by means of observers. We illustrate the benefits of our approach on a recent class of attacks targeting web servers.
Fichier non déposé

Dates et versions

hal-01292568 , version 1 (23-03-2016)

Identifiants

Citer

Jean-Baptiste Voron, Clément Démoulins, Fabrice Kordon. Adaptable Intrusion Detection Systems Dedicated to Concurrent Programs: a Petri Net-Based Approach. 10th International Conference on Application of Concurrency to System Design (ACSD'2010), Jun 2010, Braga, Portugal. pp.57-66, ⟨10.1109/ACSD.2010.32⟩. ⟨hal-01292568⟩
43 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More