The Experts below are selected from a list of 861 Experts worldwide ranked by ideXlab platform
Nizar Kheir - One of the best experts on this subject based on the ideXlab platform.
-
Response policies and counter-measure : management of Service dependencies and intrusion and reaction impacts
2020Co-Authors: Nizar KheirAbstract:Nowadays, intrusion response is challenged by both attack sophistication and the complexity of target systems. In fact, Internet currently provides an exceptional facility to share resources and exploits between novice and skilled attackers. As a matter of fact, simply detecting or locally responding against attacks has proven to be insufficient. On the other hand, in order to keep pace with the growing need for more interactive and dynamic Services, information systems are getting increasingly dependent upon modular and interdependent Service architectures. In consequence, intrusions and responses often have drastic effects as their impacts spread through Service dependencies. We argue in this thesis that Service dependencies have multiple security implications. In the context of intrusion response, Service dependencies can be used to find the proper enforcement points which are capable to support a specific response strategy. They can be also used in order to compute the impact of such responses in order to select the least costly response. In a first attempt to realize the thesis objectives, we explore graph-based Service Dependency models. We implement intrusion and response impacts as security flows that propagate within a directed graph. We introduce countermeasures as transformations to the Dependency graph, and which have direct implications on the impact flows triggered by an intrusion. In a second step, we replace the analytic graph-based approach with a simulation-based approach using colored Petri nets. We develop for this purpose a new Service Dependency model that outperforms the initial graph-based models. It represents access permissions that apply to Service dependencies. Attacker permissions are also implemented in this model by interfacing with attack graphs. We develop a simulation platform that tracks the propagation of intrusion impacts, response impacts, and the combined impacts for intrusion and response. We define a new response index, the return on response investment (RORI), that we evaluate for each response candidate with the aim to select the one that provides a maximal positive RORI index.
-
A Service Dependency model for cost-sensitive intrusion response
2016Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Recent advances in intrusion detection and prevention have brought promising solutions to enhance IT security. Despite these efforts, the battle with cyber attackers has reached a deadlock. While attackers always try to unveil new vulnerabilities, security experts are bounded to keep their softwares compliant with the latest updates. Intrusion response systems are thus relegated to a second rank because no one trusts them to modify system configuration during runtime. Current response cost evaluation techniques do not cover all impact aspects, favoring availability over confidentiality and integrity. They do not profit from the findings in intrusion prevention which led to powerful models including vulnerability graphs, exploit graphs, etc. This paper bridges the gap between these models and Service Dependency models that are used for response evaluation. It proposes a new Service Dependency representation that enables intrusion and response impact evaluation. The outcome is a Service Dependency model and a complete methodology to use this model in order to evaluate intrusion and response costs. The latter covers response collateral damages and positive response effects as they reduce intrusion costs.
-
ESORICS - A Service Dependency model for cost-sensitive intrusion response
Computer Security – ESORICS 2010, 2010Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Recent advances in intrusion detection and prevention have brought promising solutions to enhance IT security. Despite these efforts, the battle with cyber attackers has reached a deadlock. While attackers always try to unveil new vulnerabilities, security experts are bounded to keep their softwares compliant with the latest updates. Intrusion response systems are thus relegated to a second rank because no one trusts them to modify system configuration during runtime. Current response cost evaluation techniques do not cover all impact aspects, favoring availability over confidentiality and integrity. They do not profit from the findings in intrusion prevention which led to powerful models including vulnerability graphs, exploit graphs, etc. This paper bridges the gap between these models and Service Dependency models that are used for response evaluation. It proposes a new Service Dependency representation that enables intrusion and response impact evaluation. The outcome is a Service Dependency model and a complete methodology to use this model in order to evaluate intrusion and response costs. The latter covers response collateral damages and positive response effects as they reduce intrusion costs.
-
ex sdf an extended Service Dependency framework for intrusion impact assessment
Information Security Conference, 2010Co-Authors: Nizar Kheir, Frédéric Cuppens, Nora Cuppensboulahia, Hervé DebarAbstract:Information systems are increasingly dependent on highly distributed architectures that include multiple dependencies. Even basic attacks like script-kiddies have drastic effects on target systems as they easily spread through existing dependencies. Unless intrusion effects are accurately assessed, response systems will still be blinded when selecting optimal responses. In fact, using only response costs as a basis to select responses is still meaningless if not compared to intrusion costs. While conventional responses provoke mostly availability impacts, intrusions affect confidentiality, integrity and availability.
-
SEC - Ex-SDF: An Extended Service Dependency Framework for Intrusion Impact Assessment
Security and Privacy – Silver Linings in the Cloud, 2010Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Information systems are increasingly dependent on highly distributed architectures that include multiple dependencies. Even basic attacks like script-kiddies have drastic effects on target systems as they easily spread through existing dependencies. Unless intrusion effects are accurately assessed, response systems will still be blinded when selecting optimal responses. In fact, using only response costs as a basis to select responses is still meaningless if not compared to intrusion costs. While conventional responses provoke mostly availability impacts, intrusions affect confidentiality, integrity and availability.
Florian Daniel - One of the best experts on this subject based on the ideXlab platform.
-
Toward Web Service Dependency Discovery for SOA Management
2008 IEEE International Conference on Services Computing, 2008Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:The Service-oriented architecture (SOA) has become today's reference architecture for modern distributed systems. As SOA concepts and technologies become more and more widespread and the number of Services in operation within enterprises increases, the problem of managing these Services becomes manifest. One of the most pressing needs we hear from customers is the ability to "discover", within a maze of Services each offering functionality to (and in turn using functionality offered by) other Services, which are the actual dependencies between such Services. Understanding dependencies is essential to performing two functions: impact analysis (understanding which other Services are affected when a Service becomes unavailable) and Service-level root-cause analysis (which is the opposite problem: under-standing the causes of a Service failure by looking at the other Services it relies on). Discovering dependencies is essential as the hope that the enterprise maintains documentation that describe these dependencies (on top of a complex maze and evolving implementations) is vane. Hence, we have to look for dependencies by observing and analyzing the interactions among Services. In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services and we propose a solution for the automatic identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We also discuss our lessons learned and results from applying the techniques to data related to HP processes and Services.
-
IEEE SCC (2) - Toward Web Service Dependency Discovery for SOA Management
2008 IEEE International Conference on Services Computing, 2008Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:The Service-oriented architecture (SOA) has become today's reference architecture for modern distributed systems. As SOA concepts and technologies become more and more widespread and the number of Services in operation within enterprises increases, the problem of managing these Services becomes manifest. One of the most pressing needs we hear from customers is the ability to "discover", within a maze of Services each offering functionality to (and in turn using functionality offered by) other Services, which are the actual dependencies between such Services. Understanding dependencies is essential to performing two functions: impact analysis (understanding which other Services are affected when a Service becomes unavailable) and Service-level root-cause analysis (which is the opposite problem: under-standing the causes of a Service failure by looking at the other Services it relies on). Discovering dependencies is essential as the hope that the enterprise maintains documentation that describe these dependencies (on top of a complex maze and evolving implementations) is vane. Hence, we have to look for dependencies by observing and analyzing the interactions among Services. In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services and we propose a solution for the automatic identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We also discuss our lessons learned and results from applying the techniques to data related to HP processes and Services.
-
Web Service Dependency Discovery Tool for SOA Management
IEEE International Conference on Services Computing (SCC 2007), 2007Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services. The approach we take is to automate the identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We infer Service dependencies based on the correlated message traces.
-
IEEE SCC - Web Service Dependency Discovery Tool for SOA Management
IEEE International Conference on Services Computing (SCC 2007), 2007Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services. The approach we take is to automate the identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We infer Service dependencies based on the correlated message traces.
Hervé Debar - One of the best experts on this subject based on the ideXlab platform.
-
A Service Dependency model for cost-sensitive intrusion response
2016Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Recent advances in intrusion detection and prevention have brought promising solutions to enhance IT security. Despite these efforts, the battle with cyber attackers has reached a deadlock. While attackers always try to unveil new vulnerabilities, security experts are bounded to keep their softwares compliant with the latest updates. Intrusion response systems are thus relegated to a second rank because no one trusts them to modify system configuration during runtime. Current response cost evaluation techniques do not cover all impact aspects, favoring availability over confidentiality and integrity. They do not profit from the findings in intrusion prevention which led to powerful models including vulnerability graphs, exploit graphs, etc. This paper bridges the gap between these models and Service Dependency models that are used for response evaluation. It proposes a new Service Dependency representation that enables intrusion and response impact evaluation. The outcome is a Service Dependency model and a complete methodology to use this model in order to evaluate intrusion and response costs. The latter covers response collateral damages and positive response effects as they reduce intrusion costs.
-
ESORICS - A Service Dependency model for cost-sensitive intrusion response
Computer Security – ESORICS 2010, 2010Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Recent advances in intrusion detection and prevention have brought promising solutions to enhance IT security. Despite these efforts, the battle with cyber attackers has reached a deadlock. While attackers always try to unveil new vulnerabilities, security experts are bounded to keep their softwares compliant with the latest updates. Intrusion response systems are thus relegated to a second rank because no one trusts them to modify system configuration during runtime. Current response cost evaluation techniques do not cover all impact aspects, favoring availability over confidentiality and integrity. They do not profit from the findings in intrusion prevention which led to powerful models including vulnerability graphs, exploit graphs, etc. This paper bridges the gap between these models and Service Dependency models that are used for response evaluation. It proposes a new Service Dependency representation that enables intrusion and response impact evaluation. The outcome is a Service Dependency model and a complete methodology to use this model in order to evaluate intrusion and response costs. The latter covers response collateral damages and positive response effects as they reduce intrusion costs.
-
ex sdf an extended Service Dependency framework for intrusion impact assessment
Information Security Conference, 2010Co-Authors: Nizar Kheir, Frédéric Cuppens, Nora Cuppensboulahia, Hervé DebarAbstract:Information systems are increasingly dependent on highly distributed architectures that include multiple dependencies. Even basic attacks like script-kiddies have drastic effects on target systems as they easily spread through existing dependencies. Unless intrusion effects are accurately assessed, response systems will still be blinded when selecting optimal responses. In fact, using only response costs as a basis to select responses is still meaningless if not compared to intrusion costs. While conventional responses provoke mostly availability impacts, intrusions affect confidentiality, integrity and availability.
-
SEC - Ex-SDF: An Extended Service Dependency Framework for Intrusion Impact Assessment
Security and Privacy – Silver Linings in the Cloud, 2010Co-Authors: Nizar Kheir, Nora Cuppens-boulahia, Frédéric Cuppens, Hervé DebarAbstract:Information systems are increasingly dependent on highly distributed architectures that include multiple dependencies. Even basic attacks like script-kiddies have drastic effects on target systems as they easily spread through existing dependencies. Unless intrusion effects are accurately assessed, response systems will still be blinded when selecting optimal responses. In fact, using only response costs as a basis to select responses is still meaningless if not compared to intrusion costs. While conventional responses provoke mostly availability impacts, intrusions affect confidentiality, integrity and availability.
-
a Service Dependency modeling framework for policy based response enforcement
International Conference on Detection of intrusions and malware and vulnerability assessment, 2009Co-Authors: Nizar Kheir, Frédéric Cuppens, Hervé Debar, Nora Cuppensboulahia, Jouni ViinikkaAbstract:The use of dynamic access control policies for threat response adapts local response decisions to high level system constraints. However, security policies are often carefully tightened during system design-time, and the large number of Service dependencies in a system architecture makes their dynamic adaptation difficult. The enforcement of a single response rule requires performing multiple configuration changes on multiple Services. This paper formally describes a Service Dependency Framework (SDF) in order to assist the response process in selecting the policy enforcement points (PEPs) capable of applying a dynamic response rule. It automatically derives elementary access rules from the generic access control, either allowed or denied by the dynamic response policy, so they can be locally managed by local PEPs. SDF introduces a requires /provides model of Service dependencies. It models the Service architecture in a modular way, and thus provides both extensibility and reusability of model components. SDF is defined using the Architecture Analysis and Design Language, which provides formal concepts for modeling system architectures. This paper presents a systematic treatment of the Dependency model which aims to apply policy rules while minimizing configuration changes and reducing resource consumption.
Sujoy Basu - One of the best experts on this subject based on the ideXlab platform.
-
Toward Web Service Dependency Discovery for SOA Management
2008 IEEE International Conference on Services Computing, 2008Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:The Service-oriented architecture (SOA) has become today's reference architecture for modern distributed systems. As SOA concepts and technologies become more and more widespread and the number of Services in operation within enterprises increases, the problem of managing these Services becomes manifest. One of the most pressing needs we hear from customers is the ability to "discover", within a maze of Services each offering functionality to (and in turn using functionality offered by) other Services, which are the actual dependencies between such Services. Understanding dependencies is essential to performing two functions: impact analysis (understanding which other Services are affected when a Service becomes unavailable) and Service-level root-cause analysis (which is the opposite problem: under-standing the causes of a Service failure by looking at the other Services it relies on). Discovering dependencies is essential as the hope that the enterprise maintains documentation that describe these dependencies (on top of a complex maze and evolving implementations) is vane. Hence, we have to look for dependencies by observing and analyzing the interactions among Services. In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services and we propose a solution for the automatic identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We also discuss our lessons learned and results from applying the techniques to data related to HP processes and Services.
-
IEEE SCC (2) - Toward Web Service Dependency Discovery for SOA Management
2008 IEEE International Conference on Services Computing, 2008Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:The Service-oriented architecture (SOA) has become today's reference architecture for modern distributed systems. As SOA concepts and technologies become more and more widespread and the number of Services in operation within enterprises increases, the problem of managing these Services becomes manifest. One of the most pressing needs we hear from customers is the ability to "discover", within a maze of Services each offering functionality to (and in turn using functionality offered by) other Services, which are the actual dependencies between such Services. Understanding dependencies is essential to performing two functions: impact analysis (understanding which other Services are affected when a Service becomes unavailable) and Service-level root-cause analysis (which is the opposite problem: under-standing the causes of a Service failure by looking at the other Services it relies on). Discovering dependencies is essential as the hope that the enterprise maintains documentation that describe these dependencies (on top of a complex maze and evolving implementations) is vane. Hence, we have to look for dependencies by observing and analyzing the interactions among Services. In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services and we propose a solution for the automatic identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We also discuss our lessons learned and results from applying the techniques to data related to HP processes and Services.
-
Web Service Dependency Discovery Tool for SOA Management
IEEE International Conference on Services Computing (SCC 2007), 2007Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services. The approach we take is to automate the identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We infer Service dependencies based on the correlated message traces.
-
IEEE SCC - Web Service Dependency Discovery Tool for SOA Management
IEEE International Conference on Services Computing (SCC 2007), 2007Co-Authors: Sujoy Basu, Fabio Casati, Florian DanielAbstract:In this paper we identify the importance of the problem of discovering dynamic dependencies among Web Services. The approach we take is to automate the identification of traces of dependent messages, based on the correlation of messages exchanged among Services. We infer Service dependencies based on the correlated message traces.
John K Clawson - One of the best experts on this subject based on the ideXlab platform.
-
Service Dependency Analysis via TCP/UDP Port Tracing
2015Co-Authors: John K ClawsonAbstract:Service Dependency Analysis via TCP/UDP Port Tracing John K. Clawson School of Technology, BYU Master of Science Enterprise networks are traditionally mapped via layers two or three, providing a view of what devices are connected to different parts of the network infrastructure. A method was developed to map connections at layer four, providing a view of interconnected systems and Services instead of network infrastructure. This data was graphed and displayed in a web application. The information proved beneficial in identifying connections between systems or imbalanced clusters when troubleshooting problems with enterprise applications.
-
Service Dependency analysis via tcp udp port tracing
2015Co-Authors: John K ClawsonAbstract:Service Dependency Analysis via TCP/UDP Port Tracing John K. Clawson School of Technology, BYU Master of Science Enterprise networks are traditionally mapped via layers two or three, providing a view of what devices are connected to different parts of the network infrastructure. A method was developed to map connections at layer four, providing a view of interconnected systems and Services instead of network infrastructure. This data was graphed and displayed in a web application. The information proved beneficial in identifying connections between systems or imbalanced clusters when troubleshooting problems with enterprise applications.