Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction

ahamou-lhadj — Wed, 13 Nov 2013 22:49:14 +0000

A. Hamou-Lhadj, S. S. Murtaza, W. Fadel, A. Mehrabian, M. Couture, R. Khoury, "Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction," In Proc. of the ACM 2013 Research in Adaptive and Convergent Systems Conference (RACS'13), Montrela, QC, Canada 2013.

Redundancy and diversity has been shown to be an effective approach for ensuring service continuity (an important requirement for autonomic systems) despite the presence of anomalies due to attacks or faults. In this paper, we focus on operating system (OS) diversity, which is useful in helping a system survive kernel-level anomalies. We propose an approach for detecting anomalies in the presence of OS diversity. We achieve this by comparing kernel-level traces generated from instances of the same application deployed on different OS. Our trace correlation process relies on the concept of trace abstraction, in which low-level system events are transformed into higher-level concepts, freeing the trace from OS-related events. We show the effectiveness of our approach through a case study, in which we selected Linux and FreeBSD as target OS. We also report on lessons learned, setting the ground for future research.

Automated monitoring and debugging of large scale manycore heterogeneous systems - Computer Security and Reliability

Software Behaviour Correlation in a Redundant and Diverse Environment Using the Concept of Trace Abstraction

Tags: