Abstract: Attack graph is an integral part of modeling the
overview of network security. System administrators use attack graphs to determine how vulnerable their systems are and to determine
what security measures to deploy to defend their systems. Previous methods on AGG(attack graphs generation) are aiming at
the whole network, which makes the process of AGG complex and
non-scalable. In this paper, we propose a new approach which is
simple and scalable to AGG by decomposing the whole network into atomic domains. Each atomic domain represents a host with a specific privilege. Then the process for AGG is achieved by communications
among all the atomic domains. Our approach simplifies the process
of design for the whole network, and can gives the attack graphs including each attack path for each host, and when the network changes we just carry on the operations of corresponding atomic
domains which makes the process of AGG scalable.
Abstract: Intrusion detection systems (IDS)are crucial components
of the security mechanisms of today-s computer systems.
Existing research on intrusion detection has focused on sequential
intrusions. However, intrusions can also be formed by concurrent
interactions of multiple processes. Some of the intrusions caused
by these interactions cannot be detected using sequential intrusion
detection methods. Therefore, there is a need for a mechanism that
views the distributed system as a whole. L-BIDS (Lattice-Based
Intrusion Detection System) is proposed to address this problem. In
the L-BIDS framework, a library of intrusions and distributed traces
are represented as lattices. Then these lattices are compared in order
to detect intrusions in the distributed traces.