Integrated access control and intrusion detection for web servers

Abstract

Abstract-Current intrusion detection systems work in isolation from access control for the application the systems aim to protect. The lack of coordination and interoperation between these components prevents detecting and responding to ongoing attacks in real-time before they cause damage. To address this, we apply dynamic authorization techniques to support fine-grained access control and application level intrusion detection and response capabilities. This paper describes our experience with integration of the Generic Authorization and Access Control API (GAA-API) to provide dynamic intrusion detection and response for the Apache Web server. The GAA-API is a generic interface which may be used to enable such dynamic authorization and intrusion response capabilities for many applications.

Context-Sensitive Access Control Policy Evaluation and Enforcement Using Vulnerability Exploitation Data

“…The approach to integrated security used by Ryutov et al [7,8] is based the notion of an advanced security policy that can specify allowed activities, detect abuse and respond to intrusions. Each of these tasks (access control, intrusion detection and intrusion response) is performed by a single, multi-phase policy evaluator.…”

HiFIND: A high-speed flow-level intrusion detection approach with DoS resiliency

“…Most existing IDSes reside on a single host, only examining application-level [1] and system-level [2] logs, as such detailed information can identify attacks on individual machines. However, today's fast propagating viruses/ worms (e.g., SQL Slammer worm) can infect most of the vulnerable machines in the Internet within 10 min [5] or even less than 30 s with some highly virulent techniques [6,7].…”

“…However, spoofed DoS attacks will still cause collisions in TRW-AC, and leave the real port scans undetected. 1 The existing schemes can detect specific types of attacks, but will perform poorly when facing a mixture of attacks as in the real world. People may attempt to combine TRW-AC and CPM to detect both scans and SYN flooding attacks.…”

“…We have designed, implemented and evaluated a variant of the sketch, namely the k-ary sketch [42], and described how to detect heavy changes in massive data streams with small memory consumption, constant update/query complexity, and accurate estimation guarantees [42]. The k-ary sketch is similar to the count sketch 1 As the authors mentioned in [22], when the connection cache size of 1 million entries reaches about 20% full, each new scan attempt has a 20% chance of not being recorded because it aliases with an already-established connection. Actually, during spoofed DoS attacks, such collisions can become even worse.…”

“…With the rapid growth of network bandwidth and fast emergence of new attacks, viruses and worms, existing network intrusion detection systems (IDS) [1][2][3][4] are insufficient due to lack of the following features.…”