Constraints on autonomous use of standard GPU components for asynchronous observations and intrusion detection

2010 2nd International Workshop on Security and Communication Networks, IWSCN 2010

Volumn , Issue , 2010, Pages

  Riedmüller, Reinhard ^a   Seeger, Mark M ^a   Baier, Harald ^a   Busch, Christoph ^a   Wolthusen, Stephen D ^b,c  

^a Center for Advanced Security Research   (Germany)

^b UNIVERSITY OF LONDON   (United Kingdom)

^c NORWEGIAN UNIVERSITY OF SCIENCE AND TECHNOLOGY   (Norway)

Author keywords

Asynchronous memory access; Constraints; Coprocessor; CUDA; DMA; GPU; Graphics card; Host intrusion detection system; IDS

Indexed keywords

CO-PROCESSORS; CONSTRAINTS; CUDA; DMA; GPU; GRAPHICS CARD; HOST INTRUSION DETECTION SYSTEM; IDS; MEMORY ACCESS;

ALGEBRA; COMPUTER CRIME; COMPUTER GRAPHICS; COMPUTER GRAPHICS EQUIPMENT; NETWORK SECURITY; PATTERN MATCHING; PROGRAM PROCESSORS;

INTRUSION DETECTION;

EID: 77956092967     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IWSCN.2010.5497999     Document Type: Conference Paper

References (28)

1. X. Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer, "Secure Coprocessor-based Intrusion Detection," in EW10: Proceedings of the 10th workshop on ACM SIGOPS European workshop. New York, NY, USA: ACM, 2002, pp. 239-242.
2. A. Moser, C. Kruegel, and E. Kirda, "Limits of Static Analysis for Malware Detection," in Computer Security Applications Conference, 2007. ACSAC 2007. Twenty-Third Annual, 2007, pp. 421-430.
3. L. Cavallaro, P. Saxena, and R. Sekar, "On the Limits of Information Flow Techniques for Malware Analysis and Containment," in DIMVA '08: Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Berlin, Heidelberg: Springer-Verlag, 2008, pp. 143-163.
4. T. R. McEvoy and S. D. Wolthusen, "Host-Based Security Sensor Integrity in Multiprocessor Environments," in ISPEC 2010: Proceedings 6th Information Security Practice and Experience Conference. Lecture Notes in Computer Science. Springer-Verlag (in press), May 2010.
5. -, "Using Observations of Invariant Behavior to Detect Malicious Agency in Distributed Environments," in Proceedings of IT Incident Management and IT Forensics (IMF 2008). Volume 140 of Lecture Notes in Informatics, Mannheim, Germany, 2008, pp. 55-72.
6. Advanced Micro Devices, "ATI Stream Computing - Technical Overview," http://developer.amd.com/gpuassets/StreamComputingOverview.pdf, 2009, [Online; accessed 01/18/2010].
7. M. M. Seeger and S. D. Wolthusen, "Observation Mechanism and Cost Model for Tightly Coupled Asymmetric Concurrency," in ICONS 2010: Proceedings of The Fifth International Conference on Systems. IEEE Xplore (in press), Apr 2010.
8. W. D. Hillis and G. L. S. Jr., "Data parallel algorithms," Commun. ACM, vol. 29, no. 12, pp. 1170-1183, 1986.
9. I. Buck and P. Hanrahan, "Data Parallel Computation on Graphics Hardware," Stanford University - Computer Science Department, Tech. Rep., 2003.
10. I. Gelado, J. H. Kelm, S. Ryoo, S. S. Lumetta, N. Navarro, and W. mei W. Hwu, "Cuba: An architecture for efficient cpu/co-processor data communication," in ICS '08: Proceedings of the 22nd annual international conference on Supercomputing. New York, NY, USA: ACM, 2008, pp. 299-308.
11. Thomas Bradley, "Advanced CUDA Optimization - 3. Execution," http://www.gris.tu-darmstadt.de/cuda-workshop/tutorial/AdvancedCUDA03.pdf, 2010, [Online; accessed 04/02/2010].
12. NVIDIA Corporation, "CUDA 2.2 Pinned Memory APIs," NVIDIA CUDA SDK, 2009, [Online; accessed 12/01/2009].
13. -, "NVIDIA CUDA SDK," http://www.nvidia.com/object/cudasdks. html, 2010, [Online; accessed 01/18/2010].
14. Advanced Micro Devices, "ATI Stream SDK," http://developer.amd. com/gpu/ATIStreamSDK/Pages/default.aspx, 2010, [Online; accessed 01/18/2010].
15. Khronos Group, "OpenCL," http://www.khronos.org/opencl/, 2010, [Online; accessed 01/18/2010].
16. Advanced Micro Devices, "Open GPU Documentation," http://developer.amd.com/documentation/guides/Pages/default.aspx, 2010, [Online; accessed 01/18/2010].
17. J. Molina and W. Arbaugh, "Using Independent Auditors as Intrusion Detection Systems," in ICICS '02: Proceedings of the 4th International Conference on Information and Communications Security. London, UK: Springer-Verlag, 2002, pp. 291-302.
18. N. L. Petroni-Jr., T. Fraser, J. Molina, and W. A. Arbaugh, "Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor," in SSYM'04: Proceedings of the 13th conference on USENIX Security Symposium. Berkeley, CA, USA: USENIX Association, 2004, pp. 13-13.
19. A. Brinkmann and D. Eschweiler, "A microdriver architecture for error correcting codes inside the Linux kernel," in SC '09: Proceedings of the Conference on High Performance Computing Networking, Storage and Analysis. New York, NY, USA: ACM, 2009, pp. 1-10.
20. NVIDIA Corporation, "Fermi - NVIDIA's Next Generation CUDA Compute Architecture," http://www.nvidia.com/content/PDF/fermiwhitepapers/ NVIDIAFermiComputeArchitectureWhitepaper.pdf, 2009, [Online; accessed 01/18/2010].
21. E. Witchel, J. Rhee, and K. Asanović, "Mondrix: Memory Isolation for Linux using Mondriaan Memory Protection," SIGOPS Oper. Syst. Rev., vol. 39, no. 5, pp. 31-44, 2005.
22. S. Butt, V. Ganapathy, M. M. Swift, and C.-C. Chang, "Protecting Commodity Operating System Kernels from Vulnerable Device Drivers," in ACSAC'09: Proceedings of the 25th Annual Computer Security Applications Conference. Honolulu, Hawaii, USA: IEEE Computer Society Press, Los Alamitos, California, USA, December 2009, pp. 301-310.
23. E. Leontie, G. Bloom, B. Narahari, R. Simha, and J. Zambreno, "Hardware-enforced Fine-grained Isolation of Untrusted Code," in Secu-Code '09: Proceedings of the first ACM workshop on Secure execution of untrusted code. New York, NY, USA: ACM, 2009, pp. 11-18.
24. M. M. Swift, B. N. Bershad, and H. M. Levy, "Improving the Reliability of Commodity Operating Systems," in SOSP '03: Proceedings of the nineteenth ACM symposium on Operating systems principles. New York, NY, USA: ACM, 2003, pp. 207-222.
25. J. Rutkowska, "Beyond The CPU: Defeating Hardware Based RAM Acquisition (part I: AMD case)," http://www.invisiblethings.org/papers/ cheating-hardware-memory-acquisition-updated.ppt, 2007, [Online; accessed 03/09/2010].
26. T. Garfinkel and M. Rosenblum, "A Virtual Machine Introspection Based Architecture for Intrusion Detection," in In Proc. Network and Distributed Systems Security Symposium, 2003, pp. 191-206.
27. B. D. Payne and W. Lee, "Secure and Flexible Monitoring of Virtual Machines," in ACSAC, 2007, pp. 385-397.
28. H. Okhravi and D. M. Nicol, "TrustGraph: Trusted Graphics Subsystem for High Assurance Systems." in ACSAC. IEEE Computer Society, 2009, pp. 254-265.