On the reliability and availability of replicated and rejuvenating systems under stealth attacks and intrusions

Abstract

This paper considers the estimation of reliability and availability of intrusion-tolerant systems subject to non-detectable intrusions caused by stealth attacks. We observe that typical intrusion tolerance techniques may in certain circumstances worsen the dependability properties they were meant to improve. We model intrusions as a probabilistic effect of adversarial efforts and analyze different strategies of attack and rejuvenation. We compare several configurations of intrusion-tolerant replication and proactive rejuvenation, and varying mission times and expected times to node-intrusion. In doing so, we identify thresholds that distinguish between improvement and degradation of dependability, with a focus on security. We highlight the complementarity of replication and rejuvenation, showing improvements of resilience not attainable with any of the techniques alone, but possible when they are combined. We advocate the need for thorougher system models, by showing vulnerabilities arising from incomplete specifications.

Models of Reliability of Fault-Tolerant Software Under Cyber-Attacks

“…Finally, [7,28] are examples of studies that model and verify the effectiveness of cleansing (proactive recovery).…”

Towards a Practical Survivable Intrusion Tolerant Replication System

“…Theoretical models for proactive recovery have been presented in [11] and [24]. The paper in [11] compares different system configurations under parallel attacks (multiple healthy replicas are attacked at the same time) and serial attacks (only a single healthy replica is attacked at a time).…”

“…The paper in [11] compares different system configurations under parallel attacks (multiple healthy replicas are attacked at the same time) and serial attacks (only a single healthy replica is attacked at a time). That theoretical model computes the system availability, defined as the proportion of time in which the number of intruded replicas is at most f , by varying the time δ between rejuvenations of different replicas.…”

“…In our work we concentrate on serial rejuvenations and do not consider the common vulnerabilities among replicas due to the high entropy among variants generated by the MultiCompiler. In addition, we define the rejuvenation rate taking into account the size of the state that may need to be transferred and the time to transfer it, while the models in [11] and [24] are designed for stateless systems.…”

“…A theoretical model for proactive rejuvenations has also been presented in [11]. While this model applies to stateless systems, in our work we define the rejuvenation rate taking into account the size of the state that may need to be transferred and the time to transfer it.…”