Basic Approaches Of Development Of Data Center Protection Systems

Abstract

Data Center cyberprotection methods based on host-based intrusion prevention systems and network based intrusion prevention systems were considered. Basic algorithm of intrusion prevention system functioning and operational readiness evaluation which includes objects of analysis, procedures and evaluation indicators was discussed. It was shown that procedures to be done by Data Center cyber-protection system are identification of the event, signatures database management and denial management. Evaluation of intrusion prevention system efficiency was proved to be based on errors' numbers and scalability. Thereby it should include accuracy, robustness, performance and scalability parameters. Main prevention systems which show model of detection systems interaction with monitored environment events were discussed. Specifically detection strategy based classification which includes cyberattack signatures analysis, anomalies analysis, hybrid strategy, detection system behavior based classification which includes active behavior, passive behavior, monitored environment based classification which includes local network, global network, hybrid environment, detection system architecture based classification which includes centralized architecture, distributed architecture, hierarchical architecture, detection system performance based classification which includes real time analysis, offline analysis were analyzed. It was mentioned that anomaly-based systems development has to be supervised by operators and adapted to the parameters of the Data Center network. They were divided to three groups: statistical modeling, knowledge based modeling and modeling based on machine learning techniques. It was mentioned that cyber-threats could be modeled as process of transmission of data in hidden channel that change state of some functional node of Data Center. Unified mathematical model of intrusion detection system work which includes states of the infrastructure functional nodes, events involved in a system and transition between the states caused by those events was proposed.