Intrusion tolerant approach for denial of service attacks to web services

Proceedings - 1st International Conference on Data Compression, Communication, and Processing, CCP 2011

Volumn , Issue , 2011, Pages 285-292

  Ficco, Massimo ^a   Rak, Massimiliano ^a  

^a SECOND UNIVERSITY OF NAPLES   (Italy)

Author keywords

denial of service; diagnosis; intrusion recovery; intrusion tolerance; web services

Indexed keywords

DENIAL OF SERVICE; DENIAL OF SERVICE ATTACKS; INTRUSION DETECTION SYSTEMS; INTRUSION RECOVERY; INTRUSION TOLERANCE; INTRUSION TOLERANT; LEVEL OF SERVICE;

COMMUNICATION; COMPUTER CRIME; DATA COMPRESSION; DIAGNOSIS; INTRUSION DETECTION; TRANSMISSION CONTROL PROTOCOL;

WEB SERVICES;

EID: 81255200367     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CCP.2011.44     Document Type: Conference Paper

References (29)

1. M. Jensen and J. Schwenk. The accountability problem of flooding attacks in service-oriented architectures. In Proc. of the The Fourth International Conference on Availability, Reliability and Security (ARES'09), Mar. 2009, pp. 25-32. IEEE CS.
2. M. P. Papazoglou, P. Traverso, S. Dustdar, and F. Leymann. Service-oriented computing: State of the art and research challenges. In IEEE Computer, vol. 40, no. 11, 2007, pp. 38-45.
3. Witter, Facebook fend off DoS attacks, at: http://www.securityfocus.com/ brief/992. Published: Aug. 2009.
4. M. Jensen, N. Gruschka, R. Herkenh, and N. Luttenberger. SOA and Web Services: New Technologies, New Standards - New Attacks. In Proc. of the Fifth European Conference on Web Services, 2007, pp. 35-44, IEEE CS.
5. W. Iverson. Real World Web Services - Integrating EBay, Google, Amazon, FedEx and more. OReilly, 2004, no. ISBN 10: 0-596-00642-X.
6. J. Xu and W. Le. Sustaining availability of Web services under distributed denial of service attacks. In IEEE Transactions on Computers, vol. 52, no. 2, Feb. 2003, pp. 195-208.
7. V. Stavridou, B. Dutertre, R. A. Riemenschneider, and H. Saidi. Intrusion tolerant software architectures. In Proc. of DARPA Information Survivability Conference & Exposition II (DISCEX '01), vol. 2, Jun. 2001, pp. 230-241.
8. Snort: an open source network intrusion prevention and detection system (IDS/IPS). Available at: http://www.snort.org/, 2010.
9. Bro: an open source Unix based Network intrusion detection system (NIDS). Available at: http://www.bro-ids.org/, 2010.
10. M. Jensen, N. Gruschka, and R. Herkenh. A survey of attacks on web services. In Computer Science - R&D, vol. 24, no. 4, 2009, pp. 185-197.
11. S. Padmanabhuni, V. Singh, K. M. S. Kumar, and A. Chatterjee. Preventing service oriented denial of service (presodos): A proposed approach. In Proc. of the IEEE International Conference on Web Services (ICWS'06), Sept. 2006, pp. 577-584. IEEE CS.
12. S. Suriadi, C. Andrew, and S. Desmond. Validating denial of service vulnerabilities in web services. In Proc. of the IEEE Computer Society Proceedings of the Fourth International Conference on Network and System Security, 2010, pp. 175-182, IEEE CS.
13. S. Desmond, S. Suriadi, T. Alan, C. Andrew, M. George, A. Ejaz, and M. James. A distributed denial of service testbed. In Proc. of the 1st IFIP International Conference on Advances in Information and Communication Technology, LNCS 328, 2010, pp. 338-349, Springer-Verlag.
14. P. Verissimo, N. F. Neves, and M. Correia. Intrusion-tolerant architectures: concepts and design. In Architecting Dependable Systems, LNCS 2677, May 2003, pp 23-36, Springer-Verlag.
15. P. Verissimo, N. F. Neves, and M. Correia. The CRUTIAL Reference Critical Information Infrastructure Architecture: A Blueprint. In Proc. of the 1st Inter. Workshop on Critical Information Infrastructures Security (CRITIS), Aug. 2006, pp. 78-95.
16. INfrastructure for heTErogeneous, Resilient, SEcure, Complex, Tightly Inter Operating Networks, at http://www.intersection-project.eu/
17. A. Saidane, V. Nicomette, and Y. Deswarte. The design of a generic intrusion-tolerant architecture for web servers. In IEEE Transactions on Dependable and Secure Computing, vol. 6. no. 1, Jan. 2009, pp. 45-58.
18. A. Valdes, M. Almgren, S. Cheung, Y. Deswarte, B. Dutertre, J. Levy, H. Sadi, V. Stravidou, and T. E. Uribe. An adaptive intrusion-tolerant server architecture. In Proc. of the 10th International Workshop on Security Protocols, Apr. 2002, pp. 158-178.
19. F. Majorczyk, L. Totel, and L. Me. COTS Diversity Based Intrusion Detection and Application to Web Servers. In Proc. of the 8th International Symposium on Recent Advances in Intrusion Detection (RAID '05), Sept. 2005, pp. 43-62.
20. OASIS, Web Services Security: SOAP Message Security 1.1 (WS-Security 2004), OASIS, Nov. 2006, at http://docs.oasis-open.org/wss/v1.1/wss-v1.1-spec- os-SOAPMessageSecurity.pdf
21. Squid: an open source fully-featured HTTP/1.0 proxy, at http://www.squid-cache.org/
22. GreasySpoon, a real-time solution allowing you to manipulate Web traffic, at http://greasyspoon.sourceforge.net/index.html
23. Ganglia, a scalable distributed monitoring system for high-performance computing systems, at http://ganglia.sourceforge.net/
24. M. Ficco. Achieving Security by Intrusion-Tolerance Based on Event Correlation. In Special Issue on Data Dissemination for Large scale Complex Critical Infrastructures, International Journal of Network Protocols and Algorithms (NPA), vol. 2, no. 3, Oct. 2010, pp. 70-84.
25. F. Palmieri and U. Fiore. Network anomaly detection through nonlinear analysis. In Computers & Security, vol. 29, no. 7, 2010, pp. 737-755.
26. M. Ficco, L. Coppolino, and L. Romano. A Weight-Based Symptom Correlation Approach to SQL Injection Attacks. In Proc. of 4th ACM Latin-American Symposium on Dependable Computing (LADC2009), Set. 2009, ACM Press.
27. M. Serafini, A. Bondavalli, and N. Suri. Online Diagnosis and Recovery: On the Choice and Impact of Tuning Parameters. In IEEE Transactions on Dependable and Secure Computing, vol. 4, no. 4, 2007, pp. 295-312. (Pubitemid 350125895)
28. TPC Benchmark W (TPC-W), a transactional web benchmark, at http://www.tpc.org/tpcw/
29. M. Gudgin, M. Hadley, and T. Rogers. Web Services Addressing 1.0 - SOAP Binding. W3C Recommendation, May 2006.