Orchestra: Intrusion Detection Using Parallel Execution and Monitoring of Program Variants in User-Space

被引：0
|
作者：
Salamat, Babak [1 ]
Jackson, Todd [1 ]
Gal, Andreas [1 ]
Franz, Michael [1 ]
机构：
[1] Univ Calif Irvine, Dept Comp Sci, Sch Informat & Comp Sci, Irvine, CA 92717 USA
来源：
EUROSYS'09: PROCEEDINGS OF THE FOURTH EUROSYS CONFERENCE | 2009年
关键词：
process monitoring; intrusion detection; multi-variant execution; multi-core processors; vulnerability;
D O I：
暂无
中图分类号：
TP301 [理论、方法];
学科分类号：
081202 ;
摘要：
In a Multi-Variant Execution Environment (MVEE), several slightly different versions of the same program are executed in lockstep. While this is done, a monitor compares the behavior of the versions at certain synchronization points with the aim of detecting discrepancies which may indicate attacks. As we show, the monitor can be implemented entirely in user space, eliminating the need for kernel modifications. As a result, the monitor is not a part of the trusted code base. We have built a fully functioning MVEE, named Orchestra, and evaluated its effectiveness. We obtained benchmark results on a quad-core system, using two variants which grow the stack in opposite directions. The results show that the overall penalty of simultaneous execution and monitoring of two variants on a multi-core system averages about 15% relative to unprotected conventional execution.
引用
收藏
页码：33 / 46
页数：14
相关论文
共 50 条
  • [21] Combined Data and Execution Flow Host Intrusion Detection Using Machine Learning
    Rachidi, Tajjeeddine
    Koucham, Oualid
    Assem, Nasser
    INTELLIGENT SYSTEMS AND APPLICATIONS, 2016, 650 : 427 - 450
  • [22] Optimizing intrusion detection systems using parallel metric learning
    Sudha, M.
    Reddy, V. Mahesh Kumar
    Priya, W. Deva
    Rafi, Shaik Mohammad
    Subudhi, Sharmila
    Jayachitra, S.
    COMPUTERS & ELECTRICAL ENGINEERING, 2023, 110
  • [23] User Behavior-Based Intrusion Detection Using Statistical Techniques
    Malek, Zakiyabanu S.
    Trivedi, Bhushan
    Shah, Axita
    ADVANCED INFORMATICS FOR COMPUTING RESEARCH, PT II, 2019, 956 : 480 - 489
  • [24] Cognitive Approach Based User Node Activity Monitoring for Intrusion Detection in Wireless Networks
    Sunilkumar, G.
    Thriveni J.
    Venugopal, K.R.
    Patnaik, L.M.
    International Journal of Computer Science Issues, 2012, 9 (2 2-3): : 301 - 308
  • [25] Real-time decoding and streaming of DAB audio frames by a user-space program running on a non-real-time OS
    Nathan, D
    Sputh, B
    Faust, O
    Koon, CB
    IEEE TRANSACTIONS ON CONSUMER ELECTRONICS, 2002, 48 (02) : 313 - 321
  • [26] A Software-Based Error Detection Technique for Monitoring the Program Execution of RTUs in SCADA
    Rajabpour, Navid
    Sedaghat, Yasser
    COMPUTER SAFETY, RELIABILITY, AND SECURITY, SAFECOMP 2015, 2015, 9337 : 457 - 470
  • [27] Configuration of intrusion prevention systems based on a legal user: the case for using intrusion prevention systems instead of intrusion detection systems
    Chuanxi Cai
    Shue Mei
    Weijun Zhong
    Information Technology and Management, 2019, 20 : 55 - 71
  • [28] Configuration of intrusion prevention systems based on a legal user: the case for using intrusion prevention systems instead of intrusion detection systems
    Cai, Chuanxi
    Mei, Shue
    Zhong, Weijun
    INFORMATION TECHNOLOGY & MANAGEMENT, 2019, 20 (02): : 55 - 71
  • [29] Efficient execution of parallel programs using partial strict triggering of program graph nodes
    Ojstersek, M
    Zumer, V
    Pipan, L
    1997 INTERNATIONAL CONFERENCE ON PARALLEL AND DISTRIBUTED SYSTEMS, PROCEEDINGS, 1997, : 453 - 459
  • [30] Database intrusion detection using role and user behavior based risk assessment
    Singh, Indu
    Kumar, Narendra
    Srinivasa, K. G.
    Sharma, Tript
    Kumar, Vaibhav
    Singhal, Siddharth
    JOURNAL OF INFORMATION SECURITY AND APPLICATIONS, 2020, 55
12345