Paper Info
Title
Monitor placement for large-scale systems
Abstract
System administrators employ network monitors, such as traffic analyzers, network intrusion prevention systems, and firewalls, to protect the network's hosts from remote adversaries. The problem is that vulnerabilities are caused primarily by errors in the host software and/or configuration, but modern hosts are too complex for system administrators to understand, limiting monitoring to known attacks. Researchers have proposed automated methods to compute network monitor placements, but these methods also fail to model attack paths within hosts and/or fail to scale beyond tens of hosts. In this paper, we propose a method to compute network monitor placements that leverages commonality in available access control policies across hosts to compute network monitor placement for large-scale systems. We introduce an equivalence property, called flow equivalence, which reduces the size of the placement problem to be proportional to the number of unique host configurations. This process enables us to solve mediation placement problems for thousands of hosts with access control policies containing of thousands of rules in seconds (less than 125 for a network of 9500 hosts). Our method enables administrators to place network monitors in large-scale networks automatically, leveraging the actual host configuration, to detect and prevent network-borne threats.
Year
DOI
Venue
2014
10.1145/2613087.2613107
SACMAT
Keywords
Field
DocType
information flow graph scalability,large scale systems,monitor placement,security and protection
Computer security,Computer science,Intrusion prevention system,Software,Equivalence (measure theory),Access control,Network monitoring,Limiting,Distributed computing,Vulnerability
Conference
Citations 
PageRank 
References 
3
0.39
21
Authors
4
Name
Order
Citations
PageRank
Nirupama Talele1303.02
Jason Teutsch212016.84
Robert F. Erbacher320227.65
T Jaeger42635255.67