Relatore : Fabrice KORDON

Petri Nets-Based Automated and Dedicated Generation of Intrusion Detection Systems for Parallel Systems

Monitoring and maintenance of computer systems are usually synonyms of prohibitive costs. This is largely due to the complexity of current software applications and their frequent updates. System administrators cannot effectively meet security requirements when considering the high number of faults to be checked and the incredible sophistication and speed of spread of attacks. Intrusion Detection Systems implement a monitoring and analysis process of events occurring on a system in order to discover attacks compromising its confidentiality, integrity or availability. In addition to typical problems such as rates of false positives and false negatives or the inability to detect new forms intrusions, other conceptual limitations exist. Thus, few works are dealing with the protection of heavily multi-threaded applications or are offering an efficient implementation of the proposed methods of detection. The objective of this thesis is to design and implement a solution that builds an automatic monitoring system dedicated to a program. In this context, we propose to extract several behavioral models, through a static analysis of program source code to be monitored. These models are expressed by means of Petri nets. Once reduced and assembled, they may be used by current formal verification techniques and finally allow the automatic generation of a monitoring system dedicated to the original program.

Pubblicazioni 2007-2010

• 2010
  • J.‑B. Voron, C. Démoulins, F. Kordon : “Adaptable Intrusion Detection Systems Dedicated to Concurrent Programs: a Petri Net-Based Approach”, 10^th International Conference on Application of Concurrency to System Design (ACSD'2010), Braga, Portugal, pp. 57-66, (IEEE) (2010)
• 2009
  • J.‑B. Voron : “Construction automatique et particularisée de systèmes de détection d’intrusion pour les systèmes parallèles à l’aide de réseaux de Petri”, these, difesa 12/09/2009, relatore Kordon, Fabrice (2009)
• 2008
  • J.‑B. Voron, F. Kordon : “Evinrude: A Tool to Automatically Transform Program’s Sources into Petri Nets”, Petri Net Newsletter, vol. 75, pp. 19-38 (2008)
  • J.‑B. Voron, F. Kordon : “Transforming Sources to Petri Nets : A Way to Analyze Execution of Parallel Programs”, International Workshop on Petri Nets Tools and APplications (PNTAP), Marseille, France, pp. 1-10, (ACM) (2008)
• 2007
  • F. Kordon, J.‑B. Voron, L. Iftode : “Rapid Prototyping of Intrusion Detection Systems”, 18^th International Workshop on Rapid System Prototyping (RSP), Porto Alegre, Brazil, pp. 89-98, (IEEE Computer Society) (2007)