12.07.2015 Views

Journal of Emerging Technologies in Web Intelligence Contents

Journal of Emerging Technologies in Web Intelligence Contents

Journal of Emerging Technologies in Web Intelligence Contents

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

114 JOURNAL OF EMERGING TECHNOLOGIES IN WEB INTELLIGENCE, VOL. 2, NO. 2, MAY 2010prevents transitions <strong>of</strong> system states from q1 to q4. Asdiscussed above <strong>in</strong> average case transition from q1 to q4is only possible if made <strong>in</strong> .0005 seconds. Suchmechanism can be based on detect<strong>in</strong>g system callsequence required for this transition. If any suchsequence is detected it should delay (approximately .0005execution <strong>of</strong> these system calls so that before the systemstate will change from q2 or q3 to state q4, transitionfrom q1 or q2 to state q1(<strong>in</strong>itial healthy state) took place.This mechanism can be implemented by chang<strong>in</strong>goperat<strong>in</strong>g system kernel.IX. CONCLUSIONIn this paper, we propose a new time stamp<strong>in</strong>g basedapproach to check <strong>in</strong>tegrity <strong>of</strong> log files <strong>of</strong> HIDS. Thisapproach can be comb<strong>in</strong>ed with Detection and AutoRecovery based architecture to Protect Host Based IDS.As discussed <strong>in</strong> section 4, unlike other approaches ourapproach does not use virtual mach<strong>in</strong>e and hence doesnot affect system performance adversely.Our mechanism ensures that HIDS process alwayslive (cannot be killed by adversary) and the <strong>in</strong>formationrelated to HIDS can never be updated by any adversary.This architecture also ensures the <strong>in</strong>tegrity <strong>of</strong> frequentlyupdated log files <strong>of</strong> HIDS.REFERENCESFigure-4: DFA represent<strong>in</strong>g sequence <strong>of</strong> steps to disable ourarchitecture.Issue <strong>of</strong> authorization and <strong>in</strong>tegrity <strong>of</strong> genu<strong>in</strong>eupdates <strong>of</strong> HIDS <strong>in</strong>formation is another important issueto be addressed. In this approach, we did not consider anytechnique to authorize <strong>of</strong> update. Because IDS’srules/signature database requires frequent updates,<strong>in</strong>clusion <strong>of</strong> a strong authorization mechanism would berequired.[1] A. Abraham, C. Grosan and C.M. Vide. EvolutionaryDesign <strong>of</strong> Intrusion Detection Programs. International<strong>Journal</strong> <strong>of</strong> Network Security, Vol. 4, No. 3, 2007.[2] M Laureano, C Maziero, E Jamhour, Protect<strong>in</strong>g hostbased<strong>in</strong>trusion detectors through virtual mach<strong>in</strong>es-Computer Networks- Elsevier, 2007.[3] P. Chen, B. Noble, When Virtual Is Better Than Real,Workshop on Hot Topics <strong>in</strong> Operat<strong>in</strong>g Systems, 2001.[4] T. Garf<strong>in</strong>kel, M. Rosenblum, A virtual mach<strong>in</strong>e<strong>in</strong>trospection based architecture for <strong>in</strong>trusion detection,ISOC Network and Distributed System SecuritySymposium (2003).[5] S. Axelsson. Research <strong>in</strong> <strong>in</strong>trusion detection systems: Asurvey. Technical report, Chalmers University <strong>of</strong>Technology, 1999.[6] G. Dunlap, S. K<strong>in</strong>g, S. C<strong>in</strong>ar, M. Basrai, P. Chen, ReVirt:Enabl<strong>in</strong>g Intrusion Analysis through Virtual-Mach<strong>in</strong>eLogg<strong>in</strong>g and Replay, USENIX Symposium on Operat<strong>in</strong>gSystems Design and Implementation, 2002.[7] Sur<strong>in</strong>der S<strong>in</strong>gh khurana, Ms. Divya Bansal, Pr<strong>of</strong>. SanjeevS<strong>of</strong>at “Detection and Auto Recovery Approach to ProtectHost Based IDS” 2009 IEEE International AdvanceComput<strong>in</strong>g Conference (IACC 2009)© 2010 ACADEMY PUBLISHER

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!