trademark

4.0 Enpoint Input Validation/Filtering (cont.)
4.2.2 How?
Resource testing [Dou02] is a commonly implemented solution to averting Sybil attacks. It
assumes that the computing resources of each node are limited. A verifier then checks whether
each identity has as many resources as the single physical device it is associated with [BS12].
Determine if multiple fake identities possess fewer resources than expected from independent
genuine identities. Examples of resources are computing capability, storage capability, and
network bandwidth.
4.3 Use statistical similarity detection techniques and
outlier detection techniques
4.3.1 Why?
To detect and filter out malicious input.
4.3.2 How?
• Generate models that represent “normal” behavior (e.g., a Gaussian curve, and then detect
outliers that deviate from normal input, or entities that largely deviate from the Gaussian curve).
• Use a model-based approach, proximity-based approach, and an angle-based approach to
detect and filter out malicious input.
4.4 Detect and filter malicious inputs at central
collection system
4.4.1 Why?
To block malicious input data without requiring extra computation in resourceconstrained
endpoint devices.
4.4.2 How?
• Generate models that represent “normal” behavior (e.g., a Gaussian curve, and then detect
outliers that deviate from normal input, or entities that largely deviate from the Gaussian curve).
• Use a model-based approach, proximity-based approach, and an angle-based approach to
detect and filter out malicious input.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
23