Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction

ahamou-lhadj — Wed, 13 Nov 2013 22:49:14 +0000

A. Hamou-Lhadj, S. S. Murtaza, W. Fadel, A. Mehrabian, M. Couture, R. Khoury, "Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction," In Proc. of the ACM 2013 Research in Adaptive and Convergent Systems Conference (RACS'13), Montrela, QC, Canada 2013.

Redundancy and diversity has been shown to be an effective approach for ensuring service continuity (an important requirement for autonomic systems) despite the presence of anomalies due to attacks or faults. In this paper, we focus on operating system (OS) diversity, which is useful in helping a system survive kernel-level anomalies. We propose an approach for detecting anomalies in the presence of OS diversity. We achieve this by comparing kernel-level traces generated from instances of the same application deployed on different OS. Our trace correlation process relies on the concept of trace abstraction, in which low-level system events are transformed into higher-level concepts, freeing the trace from OS-related events. We show the effectiveness of our approach through a case study, in which we selected Linux and FreeBSD as target OS. We also report on lessons learned, setting the ground for future research.

Towards A Formal Framework for Evaluating the Effectiveness of System Diversity when Applied to Security

ahamou-lhadj — Wed, 13 Nov 2013 22:41:33 +0000

R. Khoury, A. Hamou-Lhadj, M. Couture, "Towards A Formal Framework for Evaluating the Effectiveness of System Diversity when Applied to Security", In Proc. of the IEEE Symposium on Computational Intelligence for Security and Defence Applications (CISDA), IEEE Computational Intelligence, Ottawa, ON, Canada, 2012.

N-version programming has been shown to be an effective way to increase the reliability of systems. In this study, we examine the possibility of extending this approach to address security, rather than reliability concerns. We focus specifically on how to evaluate the efficiency of the use of diversity for security. We show that while several key elements must be taken into account when N-version programming is used for security rather than reliability, it is nonetheless possible to devise a reasoning framework to evaluate the efficiency of this development paradigm in a security context. This framework allows us to reason about the most effective way to use diversity for security.

Automated monitoring and debugging of large scale manycore heterogeneous systems - Redundancy and Diversity

Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction

Tags:

Towards A Formal Framework for Evaluating the Effectiveness of System Diversity when Applied to Security

Tags: