RheoStat : Real-time Risk Management (2004) [3 citations — 1 self]
Abstract:
Abstract. As the frequency of attacks faced by the average host connected to the Internet increases, reliance on manual intervention for response is decreasingly tenable. Operating system and application based mechanisms for automated response are increasingly needed. Existing solutions have either been customized to specific attacks, such as disabling an account after a number of authentication failures, or utilize harsh measures, such as shutting the system down. In contrast, we present a framework for systematic fine grained response that is achieved by dynamically controlling the host’s exposure to perceived threats. This paper introduces a formal model to characterize the risk faced by a host. It also describes how the risk can be managed in real-time by adapting the exposure. This is achieved by modifying the access control subsystem to let the choice of whether to grant a permission be delegated to code that is customized to the specific right. The code can then use the runtime context to make a more informed choice, thereby tightening access to a resource when a threat is detected. The running time can be constrained to provide performance guarantees. The framework was implemented by modifying the Java Runtime. A suite of vulnerable Jigsaw servlets and corresponding attacks was created. The following were manually added: code for dynamic permission checks; estimates of the reduction in exposure associated with each check; the frequencies with which individual permissions occurred in a typical workload; a global risk tolerance. The resulting platform disrupted the attacks by denying the permissions needed for their completion. 1
Citations
| 7706 | Computers and Intractability: A Guide to the Theory of NP-Completeness – Garey, Johnson - 1979 |
| 264 | EMERALD: Event monitoring enabling responses to anomalous live disturbances – Porras, Neumann - 1997 |
| 206 | State Transition Analysis: A Rule-Based Intrusion Detection Approach – Ilgun, Kemmerer, et al. - 1995 |
| 9 | A new fully polynomial approximation scheme for the knapsack problem – Kellerer, Pferschy - 1998 |
| 6 | NDIX -- A Real-Time Intrusion Detection Expert System – Bauer, Koblentz - 1988 |
| 4 | Quantitative Risk Analysis of Computer Networks – Bilar - 2003 |
| 3 | Agent-based Intrusion Response – Carver, Adaptive - 2001 |
| 3 | Intrusive Damage Control and Assessment Techniques – Fisch - 1996 |
| 2 | Guidelines for Automatic Data Processing Physical Security and Risk Management – Hoo - 2002 |
| 1 | Support for Automated Passive Host-based Intrusion Response – Gehani - 2003 |
| 1 | The Evolution of Java Security – Koved, Nadalin, et al. - 1998 |
