Software fault tree and coloured Petri net based specification, design and implementation of agent-based intrusion detection systems

Abstract

Abstract:The integration of Software Fault Tree (SFT), which describes intrusions and Coloured Petri Nets (CPNs) that specifies design, is examined for an Intrusion Detection System (IDS). The IDS under development is a collection of mobile agents that detect, classify, and correlate the system and network activities. SFTs, augmented with nodes that describe trust, temporal and contextual relationships, are used to describe intrusions. CPNs for intrusion detection are built using CPN templates created from the augmented SFTs. Hierarchical CPNs are created to detect critical stages of intrusions. The agentbased implementation of the IDS is then constructed from the CPNs. Examples of intrusions and descriptions of the prototype implementation are used to demonstrate how the CPN approach has been used in the development of the IDS.The main contribution of this paper is an approach to systematic specification, design and implementation of an IDS; Innovations include (1) using stages of intrusions to structure the specification and design of the IDS; (2) augmentation of SFT with trust, temporal and contextual nodes to model intrusions; (3) algorithmic construction of CPNs from augmented SFT; and (4) generation of mobile agents from CPNs.Keywords: coloured Petri nets; information and computer security; intrusion detection systems; mobile agents; software fault tree analysis.Reference to this paper should be made as follows: Helmer, G., Wong, J., Slagell, M., Honavar, V., Miller, L., Wang, Y., Wang, X. and Stakhanova, N. (2007) 'Software fault tree and coloured Petri net-based specification, design and implementation of agent-based intrusion detection systems', Int.

Analysis of Timing Requirements for Intrusion Detection and Prevention using Fault Tree with Time Dependencies

“…We start the FTTD analysis by identifying the time interval, when the hazard can occur using formula (4). More information about it is given in [10].…”

“…Intrusion detection systems (IDS) base their operation on the built-in patterns of various attack strategies. Aforementioned strategies can be represented by different means like: augmented goal-tree [6], attack trees [17] (originated from on fault trees), attack graphs [14], or augmented software fault trees [4]. In augmented goal tree representation [6], the attack is expressed by sequences of logically related steps.…”

“…By assigning probabilities of success on the arcs, one can identify the attack paths with the highest probability of success. Augmented software fault trees [4] were defined in order to overcome disadvantages of the classical fault trees. In this approach, a trust, a context, and temporal orderings can be defined.…”

A new intrusion prevention model using planning knowledge graph

“…Therefore, intrusion prevention has aroused extensive attention as a system of not only is able to identify an invasion but also respond to the invasion. In order to improve the intelligence level of intrusion detection system, plan recognition has a number of successful applications in the intrusion detection system, and has played an important role in improve the performance of the system [1][2][3][4][5].Planning knowledge graph [6,7] has the features of is simple to understand, easy to implement as a new planning knowledge model, and can predict the next actions, so it has important significance for intrusion prevention. The same time the planning knowledge graph and HTN intelligent planning are almost entirely similar in planning knowledge storage and inference mechanism, so which is very beneficial to knowledge sharing of intelligent planning and plan recognition.…”

Modeling and Execution of Complex Attack Scenarios using Interval Timed Colored Petri Nets

“…Petri nets and Colored Petri nets have, however, been used extensively in the design and implementation of intrusion detection systems such as those by Kumar and Spafford [18] and Helmer et al [12] along with related formalisms based on timed finite state machines such as the approach proposed by Chang et al [6], which may be considered as complementary to the approach described in this paper.…”