A model-based approach to self-protection in computing system

作者：Qian Chen, Sherif Abdelwahed, Abdelkarim Erradi · 年份：2013 · DOI：10.1145/2494621.2494639 · 被引用次数：24 · 研究领域：Network Security and Intrusion Detection、Advanced Malware Detection Techniques、Software System Performance and Reliability

This paper introduces a model-based autonomic security management (ASM) approach to estimate, detect and identify security attacks along with planning a sequence of actions to effectively protect the networked computing system. In the proposed approach, sensors collect system and network parameters and send the data to the forecasters and the intrusion detection systems (IDSes). A multi-objective controller selects the optimal protection method to recover the system based on the signature of attacks. The proposed approach is demonstrated on several case studies including Denial of Service (DoS) attacks, SQL Injection attacks and memory exhaustion attacks. Experiments show that the ASM approach can successfully defend and recover the victim host from known and unknown attacks while maintaining QoS with low overheads.