No abstract

No abstract

We have built a system for protecting web servers to securely connected, known users that includes an innovative use of diversity for on-line attack identification. We are able to use attack identification to immediately protect the system without debilitating waits for anti-virus updates or software patches by positively verifying attacks with a sandbox. Unique to our approach is the use of diverse process pairs not only for isolation benefits but also for detection. The architecture uses the comparison of outputs from diverse applications to provide a significant and novel intrusion detection capability. With this technique, we gain the benefits of n-version programming without its controversial disadvantages. Diversity of applications also contributes to the isolation of intrusions by software, which is further improved by random rejuvenation.