Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
NPC-2004 Oct. 18, 2004<br />
Relative Performance <strong>of</strong> Three Scheduling<br />
Algorithms on the NAS Workload under<br />
Three Different Risky Conditions<br />
Scheduling Algorithms Makespan (sec) Ave. Rsp. Time (sec) Ranking<br />
The Total Execution Time <strong>of</strong> 5,000 jobs<br />
on 20 <strong>Grid</strong> sites with10 levels <strong>of</strong> site speed<br />
--- Makespan in second under the PSA workload with uniform<br />
distributions on the site security level (0.4 – 1.0) and on the job<br />
security demand (0.6-0.9)<br />
Min-Min <strong>Secure</strong> 6491186 131% 1308360 203% ≈ 4 th<br />
0.5-Risky 5714605 115 % 926952 144 % ≈ 3 rd<br />
Risky 5402546 109 % 811873 126 % ≈ 2 nd<br />
Sufferage <strong>Secure</strong> 6454823 130 % 1292948 201 % ≈ 4 th<br />
0.5-Risky 5834757 118 % 999765 155 % ≈ 3 rd<br />
Risky 5441722 110 % 819667 127 % ≈ 2 nd<br />
STGA 4939777 100 % 643076 100 % 1 st<br />
Makespan(seconds)<br />
2.0x10 6<br />
1.5x10 6<br />
1.0x10 6<br />
5.0x10 5<br />
0.0<br />
Min-min<br />
1 2 3 4 5 6 7<br />
<strong>Secure</strong><br />
Min-min<br />
f-Risky<br />
Min-min<br />
Risky<br />
Sufferage<br />
<strong>Secure</strong><br />
Sufferage<br />
f-<strong>Secure</strong><br />
Sufferage<br />
Risky<br />
STGA<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
19<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
20<br />
Total <strong>Grid</strong> Site Resource Utilization (%)<br />
Basic Concept <strong>of</strong> Internet Episodes<br />
--- Plotted for a partially risky situation with f = 0.5<br />
under the PSA workload distributed to 20 <strong>Grid</strong> sites<br />
100<br />
• Event Type: A, B, C, D, E, F, etc.<br />
Site Utilization (%)<br />
80<br />
60<br />
40<br />
20<br />
0<br />
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20<br />
<strong>Grid</strong> Resource Site<br />
Min-Min f-risky<br />
Sufferage f-risky<br />
STGA<br />
• Event Sequence: e.g., <br />
• Window: Event sequence with a particular width<br />
• Episode: partially ordered set <strong>of</strong> events, e.g. whenever A occurs, B<br />
will occur soon<br />
• Frequency <strong>of</strong> episode: fraction <strong>of</strong> windows in which episode occurs<br />
• Frequent episode: set <strong>of</strong> episodes having a frequency over a<br />
particular frequency threshold<br />
• Frequent episode rules are generated to describe the<br />
connection events<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
21<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
22<br />
Frequent Episode Rules (FER)<br />
for Characterizing Network Traffic Connections<br />
E → D, F ( c, s )<br />
The episode <strong>of</strong> 3 connection events (E, D, F) = (http, smpt, telent).<br />
On the LHS , we have the event E (http). On the RHS, we have two<br />
consequence events D (smpt) and F(telnet); where s is the<br />
support probablity and c is the confidence level specified below:<br />
(service = http, flag = SF) →<br />
(service = smpt, srcbyte = 5000),<br />
(service = telnet, flag = SF) (0.8, 0.9)<br />
Support probability s = 0.9 and Confidence level c = 0.8 that the<br />
episode will take place in a typical traffic stream<br />
The JAIDS Architecture<br />
Audit records<br />
from traffic data<br />
Known<br />
attack<br />
signatures<br />
from ISD<br />
provider<br />
Single-connection attacks<br />
detected at packet level<br />
IDS<br />
Signature<br />
Matching<br />
Engine<br />
Attack<br />
Signature<br />
Database<br />
Unknown<br />
or burst<br />
attacks<br />
New<br />
signatures<br />
from<br />
anomalies<br />
detected<br />
Episode Rule<br />
Database<br />
ADS<br />
Training data from<br />
audit normal traffic<br />
records<br />
Episode<br />
Mining<br />
Engine<br />
ADS<br />
Signature<br />
Generator<br />
Anomalies detected<br />
over multiple<br />
connections<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
23<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
24<br />
Keynote Presentation at the IFIP International Conference on Network and Parallel <strong>Computing</strong>,<br />
(NPC 2004), Wuhan, China, Oct. 18, 2004 4
Change language