Constructing Detection Knowledge for DDoS Intrusion Tolerance

ASIAIR > College of Computer Science > Department of Applied Informatics and Multimedia > Journal Article > Item 310904400/4746

Please use this identifier to cite or link to this item: http://asiair.asia.edu.tw/ir/handle/310904400/4746

Title:	Constructing Detection Knowledge for DDoS Intrusion Tolerance
Authors:	Shun-Chieh Lin;S. S. Tseng
Contributors:	Department of Information Science and Applications
Keywords:	Distributed denial of service (DDoS);Intrusion tolerance;Ontology;Knowledge acquisition;NORM
Date:	2004-10
Issue Date:	2009-11-30 08:03:23 (UTC+0)
Publisher:	Asia University
Abstract:	Intrusion tolerance is the ability of a system to continue providing (possibly degraded but) adequate services after a penetration. With the rapid development of network technology, distributed denial of service (DDoS) attacks become one of the most important issues today. In this paper, we propose a DDoS ontology to provide a common terminology for describing the DDoS models consisting of the Profile model (the representation of the behaviors of system and users) and the Defense model (the descriptions of Detection and Filter methodologies). Also, the Evaluation strategy based upon current statuses of users' behaviors is used to evaluate the degree of the intrusion tolerance of the proposed models during DDoS attacks. Based upon the ontology, four KCs (Profile model, Evaluation strategy, Detection methodology, and Filter methodology Knowledge Classes) and their relationships are then proposed, where each KC may contain a set of sub-KCs or knowledge represented as a natural rule format. For an arbitrarily given network environment, the default knowledge in the Profile KC and the Evaluation KC, the appropriate detection features in the Detection KC, and the suitable access control list policies in the Filter KC can be easily extracted and adopted by our proposed integrated knowledge acquisition framework. We are now implementing a NORM-based DDoS intrusion tolerance system for DDoS attacks to evaluate the proposed models.
Relation:	Expert Systems with Applications 27:379-390
Appears in Collections:	[Department of Applied Informatics and Multimedia] Journal Article

Files in This Item:

File	Description	Size	Format
		0Kb	Unknown	751	View/Open
310904400-4746.doc		40Kb	Microsoft Word	280	View/Open

Loading...