Storage-based intrusion detection: watching storage activity for suspicious behavior (2003)
Cached
Download Links
| Venue: | In Proceedings of the 12th USENIX Security Symposium |
| Citations: | 43 - 5 self |
BibTeX
@INPROCEEDINGS{Pennington03storage-basedintrusion,
author = {Adam G. Pennington and John D. Strunk and John Linwood Griffin and Craig A. N. Soules and Garth R. Goodson and Gregory R. Ganger},
title = {Storage-based intrusion detection: watching storage activity for suspicious behavior},
booktitle = {In Proceedings of the 12th USENIX Security Symposium},
year = {2003}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Storage-based intrusion detection allows storage systems to transparently watch for suspicious activity. Storage systems are well-positioned to spot several common intruder actions, such as adding backdoors, inserting Trojan horses, and tampering with audit logs. Further, an intrusion detection system (IDS) embedded in a storage device continues to operate even after client systems are compromised. This paper describes a number of specific warning signs visible at the storage interface. It describes and evaluates a storage IDS, embedded in an NFS server, demonstrating both feasibility and efficiency of storage-based intrusion detection. In particular, both the performance overhead and memory required (40 KB for a reasonable set of rules) are minimal. With small extensions, storage IDSs can also be embedded in block-based storage devices.
