FloGuard: Cost-aware systemwide intrusion defense via online forensics and on-demand IDS deployment

Saman Aliari Zonouz, Kaustubh R. Joshi, William H. Sanders

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Scopus citations

Abstract

Detecting intrusions early enough can be a challenging and expensive endeavor. While intrusion detection techniques exist for many types of vulnerabilities, deploying them all to catch the small number of vulnerability exploitations that might actually exist for a given system is not cost-effective. In this paper, we present FloGuard, an on-line intrusion forensics and on-demand detector selection framework that provides systems with the ability to deploy the right detectors dynamically in a cost-effective manner when the system is threatened by an exploit. FloGuard relies on often easy-to-detect symptoms of attacks, e.g., participation in a botnet, and works backwards by iteratively deploying off-the-shelf detectors closer to the initial attack vector. The experiments using the EggDrop bot and systems with real vulnerabilities show that FloGuard can efficiently localize the attack origins even for unknown vulnerabilities, and can judiciously choose appropriate detectors to prevent them from being exploited in the future.

Original languageEnglish (US)
Title of host publicationComputer Safety, Reliability, and Security - 30th International Conference, SAFECOMP 2011, Proceedings
Pages338-354
Number of pages17
DOIs
StatePublished - Sep 26 2011
Event30th International Conference on Computer Safety, Reliability and Security, SAFECOMP 2011 - Naples, Italy
Duration: Sep 19 2011Sep 22 2011

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6894 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other30th International Conference on Computer Safety, Reliability and Security, SAFECOMP 2011
CountryItaly
CityNaples
Period9/19/119/22/11

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'FloGuard: Cost-aware systemwide intrusion defense via online forensics and on-demand IDS deployment'. Together they form a unique fingerprint.

Cite this