Learning unknown attacks - a start

  • Authors:

  • James E. Just;James C. Reynolds;Larry A. Clough;Melissa Danforth;Karl N. Levitt;Ryan Maglich;Jeff Rowe

  • Affiliations:

  • Teknowledge Corporation, Fairfax, VA;Teknowledge Corporation, Fairfax, VA;Teknowledge Corporation, Fairfax, VA;University of California, Davis, CA;University of California, Davis, CA;Teknowledge Corporation, Fairfax, VA;University of California, Davis, CA

  • Venue:
  • RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
  • Year:
  • 2002

Quantified Score

Hi-index 0.00

Visualization

Abstract

Since it is essentially impossible to write large-scale software without errors, any intrusion tolerant system must be able to tolerate rapid, repeated unknown attacks without exhausting its redundancy. Our system provides continued application services to critical users while under attack with a goal of less than 25% degradation of productivity. Initial experimental results are promising. It is not yet a general open solution. Specification-based behavior sensors (allowable actions, objects, and QoS) detect attacks. The system learns unknown attacks by relying on two characteristics of network-accessible software faults: attacks that exploit them must be repeatable (at least in a probabilistic sense) and, if known, attacks can be stopped at component boundaries. Random rejuvenation limits the scope of undetected errors. The current system learns and blocks single-stage unknown attacks against a protected web server by searching and testing service history logs in a Sandbox after a successful attack. We also have an initial class-based attack generalization technique that stops web-server buffer overflow attacks. We are working to extend both techniques.