Anomaly detection with diagnosis in diversified systems using information flow graphs

IFIP International Federation for Information Processing

Volumn 278, Issue , 2008, Pages 301-315

  Majorczyk, Frédéric ^a   Totel, Eric ^a   Mé, Ludovic ^a   Saïdane, Ayda ^b  

^a SUPELEC Campus de Rennes   (France)

^b UNIVERSITY OF TRENTO   (Italy)

Author keywords

Anomaly detection; Anomaly diagnosis; COTS diversity; Design diversity; Graph similarity

Indexed keywords

FAULT TOLERANCE; FLOW GRAPHS; GRAPHIC METHODS; INTRUSION DETECTION;

ANOMALY DIAGNOSIS; BLACK BOX APPROACH; DESIGN DIVERSITY; DETECTION COVERAGE; GRAPH SIMILARITY; INFORMATION FLOW GRAPHS;

ANOMALY DETECTION;

EID: 48249102627     PISSN: 15715736     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-0-387-09699-5_20     Document Type: Conference Paper

References (10)

1. Bharathi, V.: N-version programming method of software fault tolerance: A critical review. In: National Conference on Nonlinear Systems and Dynamics (NCNSD). Kharagpur, India (2003)
2. Champin, P.A., Solnon, C.: Measuring the similarity of labeled graphs. In: In Proceedings of the 5th International Conference on Case-Based Reasoning (ICCBR 2003), pp. 80-95. Trondheim, Norway (2003)
3. d'Ausbourg, B.: Implementing secure dependencies over a network by designing a distributed security subsystem. In: Proceedings of the European Sysmposium on Research in Computer Security (ESORICS'94), pp. 249-266 (1994)
4. Gao, D., Reiter, M.K., Song, D.: Behavioral distance for intrusion detection. In: Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID 2005), pp. 63-81. Seattle, WA (2005)
5. Gao, D., Reiter,M.K., Song, D.: Behavioral distance measurement using hidden markov models. In: Proceedings of the 9th International Symposium on Recent Advances in Intrusion Detection (RAID 2006), pp. 19-40. Hamburg, Germany (2006)
6. Just, J.E., Reynolds, J.C., Clough, L.A., Danforth, M., Levitt, K.N., Maglich, R., Rowe, J.: Learning unknown attacks - a start. In: A. Wespi, G. Vigna, L. Deri (eds.) Proceedings of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID 2002), Lecture Notes in Computer Science, vol. 2516, pp. 158-176. Zurich, Switzerland (2002)
7. Porras, P.A., Neumann, P.G.: EMERALD: Event monitoring enabling responses to anomalous live disturbances. In: Proc. of the 20th National Information Systems Security Conference, pp. 353-365. Baltimore, MD (1997). URL http://www2.csl.sri.com/emerald/emerald-niss97.html
8. Totel, E., Majorczyk, F., Mé, L.: COTS diversity based intrusion detection and application to web servers. In: Proceedings of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID 2005), pp. 43-62. Seattle, WA (2005)
9. Veríssimo, P.E., Neves, N.F., Correia, M.P.: Intrusion-tolerant architectures: Concepts and design. In: Architecting Dependable Systems, Lecture Notes in Computer Science, vol. 2677. Springer-Verlag (2003)
10. Vigna, G., Robertson, W., Kher, V., Kemmerer, R.A.: A stateful intrusion detection system for world-wide web servers. In: Proceedings of the Annual Computer Security Applications Conference (CSAC 2003), pp. 34-43. Las Vegas, Nevada (2003)