Observation Mechanism and Cost Model for Tightly Coupled Asymmetric Concurrency

The cost of observation for intrusion detection: Performance impact of concurrent host observation

“…The workload generator is a C++ console program producing a synthetic workload by continuously writing to a data structure of a pre-defined size. The idea behind this program corresponds to the basic statement of [7]: A forced synchronization between different memory levels (i.e. a cache and the main memory) takes place, whenever two conditions are met: (1) The higher level holds an altered copy [m] of the original but outdated data [m] which resides in the physical memory.…”

“…the host's main memory) and putting it under the audit of an auxiliary processor has contributed its part to this development. The use of graphics chipsets or PCI processing devices ( [6]) and GPUs in general ( [7]) for host intrusion detection has been mentioned in previous work. While [6] mostly deal with selfprotection of the observing component itself, [7] introduce a model capable of expressing the costs such observations can cause.…”

“…The use of graphics chipsets or PCI processing devices ( [6]) and GPUs in general ( [7]) for host intrusion detection has been mentioned in previous work. While [6] mostly deal with selfprotection of the observing component itself, [7] introduce a model capable of expressing the costs such observations can cause. That is, the authors pay special attention to concurrent memory accesses, particularly in a NUMA architecture as represented by a standard multi-core (and especially multiprocessor) system.…”

“…Although the model proposed in [7] and utilised here is intended mainly for high-speed interconnections such as these offered by GPU and similar components, it is applicable to all non-uniform concurrent memory access architectures. The read-only (observation) access to a state variable of a target process can cross several cascading memory hierarchy layers with the ultimate shared resource in such architectures generally being main memory.…”

“…As snooping and cache coher-ence protocols allow the efficient but forced synchronisation without the possibility of intervention on the part of software components, this provides a mechanism for concurrent state observations that cannot be corrupted or compromised. While [7] is concerned about observations executed by the GPU, similar effects with regard to resource contention and ultimately performance degradation on the host system can be caused by every memory access using DMA. Having in mind the limitations revealed by [8] we thus propose another hardware based approach in this paper: That is, we exploited the ability of the IEEE 1394 technology in order to gain full access to the main memory of a connected computer.…”