Beyond output voting: Detecting compromised replicas using HMM-based behavioral distance

• Main Authors: GAO, Debin, Reiter, Michael K., SONG, Dawn
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2009
• Subjects: Fault-tolerance; Information flow controls; Intrusion detection; Measurements; Network-level security and protection; Performance measures; Protection mechanisms; Reliability; Security; Unauthorized access (hacking; Web server; and serviceability; availability; behavioral distance.; output voting; phreaking); replicated system; system call; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/765; https://ink.library.smu.edu.sg/context/sis_research/article/1764/viewcontent/Beyond_output_voting_Detecting_compromised_replicas_using_HMM_based_behavioral_distance.pdf
• Institution: Singapore Management University

Many host-based anomaly detection techniques have been proposed to detect code-injection attacks on servers. The vast majority, however, are susceptible to "mimicry" attacks in which the injected code masquerades as the original server software, including returning the correct service resp...