A Grid-based Fault-Tolerant Intrusion Detection Environment

Autor: Ming-Chang Li, 李明昌
Rok vydání: 2006
Druh dokumentu: 學位論文 ; thesis
Popis: 94
Nowadays, Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) are the most destructive network threats coming from Internet. Hackers, exploiting all kinds of malicious softwares to attack and usurp network hosts, servers and bandwidth, have seriously damaged enterprises, campus and governments network systems. Many network administrators employ Intrusion Detection Systems (IDSs) and/or firewalls to protect their systems. However, some lose most of their detection and/or protection capabilities when facing a huge volume of attack packets. Also, some detection resources may fail due to hardware and/or software faults. In this article, we propose a Grid-based intrusion detection platform, named Dynamic Grid Intrusion Detection Environment (DGIDE), which exploiting grid’s dynamic and abundant computing resources to detect intrusion packets, is a fault-tolerant platform that provides three types of backup mechanisms to prevent the DGIDE from crash. The first type is on-line standby in which the standby subsystem performs the same task as its ordinary one. When the working subsystem fails, the standby takes over current task immediately with less delay and without information passing. The other two are offline backup. When the working subsystem fails, DGIDE notifies the backup subsystem to take over. With these mechanisms, the reliability of an ordinary security system can be then improved. Besides DoS/DDoS, DGIDE also detects logical attacks. The definite information of an intrusion is stored in database which can be accessed by detector to avoid any detector repeatedly detecting the subsequent packets of some previously detected attack, thus significantly reducing the detection resources consumed and used. Comparing to other IDSs, DGIDE’s detection effectiveness is higher and detection time is shorter.
Databáze: Networked Digital Library of Theses & Dissertations