Attacks on information systems followed by intrusions may cause large revenue losses. The prevention of both is not always possible by just considering information from isolated sources of the network. A global view of the whole system is necessary to recognize and react to the different actions of such an attack. The design and deployment of a decentralized system targeted at detecting as well as reacting to information system attacks might benefit from the loose coupling realized by publish subscribe middleware. In this paper, we present the advantages and convenience in using this communication paradigm for a general decentralized attack prevention framework. Furthermore, we present the design and implementation of our approach based on existing publish subscribe middleware and evaluate our approach for GNU Linux systems.
Most of these limitations can be solved efficiently by using a distributed publish sub -scribe middleware. The advantages of publish subscribe communication for our problem domain over other communication paradigms is that it keeps the producers of messages decoupled from the consumers and that the communication is information-driven. This way, it is possible to avoid problems regarding the scalability and the management inherent to other designs by means of a network of publishers, brokers, and subscribers. A publisher in a publish subscribe system does not need to have any knowledge about any of the entities that consume the published information since the communication is anonymous. Likewise, the subscribers do not need to know anything about the publishers. New services can simply be added without any impact on or interruption of the service to other users. @cite_3 @cite_13 , we presented an infrastructure inspired by the decentralized architectures discussed with the focus on removing the discussed limitations. In the following sections, we present further details on our work.
@cite_13 @cite_3
2544168507 95147369
The cooperation between the different entities of a decentralized prevention system can be solved efficiently using the publish subscribe communication model. Here, clients can share and correlate alert information about the systems they monitor. In this paper, we present the advantages and convenience in using this communication model for a general decentralized prevention framework. Additionally, we outline the design for a specific architecture, and evaluate our design using a freely available publish subscribe message oriented middleware Distributed and coordinated attacks can disrupt electronic commerce applica- tions and cause large revenue losses. The prevention of these attacks is not possible by just considering information from isolated sources of the network. A global view of the whole system is necessary to react against the different actions of such an attack. We are currently working on a decentralized attack prevention framework that is targeted at detecting as well as reacting to these attacks. The cooperation between the different entities of this system has been efficiently solved through the use of a publish subscribe model. In this paper we first present the advantages and convenience in using this communication paradigm for a general decentralized attack prevention framework. Then, we present the design for our specific approach. Finally, we shortly discuss our implementation based on a freely available publish subscribe message oriented middleware.