OS diversity for intrusion tolerance: Myth or reality?

Abstract

Abstract-One of the key benefits of using intrusion-tolerant systems is the possibility of ensuring correct behavior in the presence of attacks and intrusions. These security gains are directly dependent on the components exhibiting failure diversity. To what extent failure diversity is observed in practical deployment depends on how diverse are the components that constitute the system. In this paper we present a study with operating systems (OS) vulnerability data from the NIST National Vulnerability Database. We have analyzed the vulnerabilities of 11 different OSes over a period of roughly 15 years, to check how many of these vulnerabilities occur in more than one OS. We found this number to be low for several combinations of OSes. Hence, our analysis provides a strong indication that building a system with diverse OSes may be a useful technique to improve its intrusion tolerance capabilities.

Designing and Implementing a Diversity Policy for Intrusion-Tolerant Systems

“…Garcia et al carried out a study with OSs vulnerability data from the NVD [12]. The authors analyzed the vulnerabilities of 11 OSs to find the number of vulnerabilities that occur in more than one OS.…”

An intrusion-tolerant firewall design for protecting SIEM systems

“…We assume that at most f pf prefilters fail of a total of N pf = f pf + k (with k > 1), and that out of the N f = 3f f + 1 filters at most f f fail. To enforce this assumption it is necessary to ensure that firewall components fail independently, which typically can be achieved with good coverage if one employs diversity [15]. A failed pre-filter can for instance modify the received traffic or generate invalid messages that are given to the filtering stage.…”

Prevention of Zero Day Vulnerability in Network Using Ensemble Fuzzy Association and Cuttle Fish

“…Second, the network diversity metric is designed [5] based on the attacking effort and their effect on the relationship between the resources. Third, the complementary metric called probabilistic network diversity security metric is modeled [6] to reflect the average attacking effort. Finally, the highlighted three metrics are validated with the various simulations under different cases.…”

“…The evolution of target defense and diversity strategies in research studies rely on intuitive notions of diversity. Hence, the impact of network diversity on the security has received the limited attention [6] which is considered as the background of the proposed research. Our proposed research deals with the detection of intrusion attack in the eclipse database with the help of Ensemble Fuzzy Association (EFA) and Cuttle Fish Algorithm (CFA).…”

“…According to the recent evidence report such as modern malware exploits the multiple unknown vulnerabilities, equal treatment of unknown vulnerabilities is necessary to improve the resilience of network against the attacks. The dealing of unknown vulnerabilities is the challenging task and it is regarded as the zero-day attacks and the lack of information [6] introduces the difficulties in mitigation. The evolution of target defense and diversity strategies in research studies rely on intuitive notions of diversity.…”