Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
NPC-2004 Oct. 18, 2004<br />
ROC Curves for 4 Attack Classes<br />
on The Simulated JAIDS<br />
ROC Performance <strong>of</strong> Three<br />
Intrusion Detection Systems<br />
Intrusion Detection Rate (%)<br />
80<br />
70<br />
60<br />
50<br />
40<br />
30<br />
20<br />
10<br />
0<br />
0 2 4 6 8 10 12<br />
False Alarm Rate (%)<br />
DoS<br />
Pr obe<br />
R2L<br />
U2R<br />
Intrusion Detection Rate<br />
(%)<br />
80<br />
70<br />
60<br />
50<br />
40<br />
30<br />
20<br />
10<br />
0<br />
0 2 4 6 8 10 12<br />
False Alarm Rate (%)<br />
JAIDS<br />
Snor t<br />
ADS<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
31<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
32<br />
Final Remarks:<br />
• The security-driven Min-Min and Sufferage heuristics and the<br />
new space-time genetic algorithm (STGA) are fast and easy to<br />
implement in a risky open <strong>Grid</strong> environment to yield<br />
satisfactory performance with low overhead.<br />
• The new Internet episode detection scheme (JAIDS) can cope<br />
with both known and unknown network attacks. This will<br />
secure many <strong>Grid</strong>/P2P operations in using common Internet<br />
services: telnet, http, ftp, smtp, Email, authentication, etc.<br />
• The NetShield self-defense IDS/IRD system is still under<br />
development at USC. For ultra security-sensitive <strong>Grid</strong> services,<br />
we recommend the use <strong>of</strong> dedicated VPN tunnels to secure <strong>Grid</strong><br />
communications and safeguard P2P download operations.<br />
Hot Research Thrust Areas:<br />
• Perfection <strong>of</strong> the trust models for protecting virtual<br />
organizations with scalable <strong>Grid</strong> applications without worry<br />
about infections or becoming victims by participating in<br />
collective operations – In particular, the fuzzy- and gametheoretical<br />
approaches are promising.<br />
• Large-scale benchmark experiments on open <strong>Grid</strong>s are<br />
desired to work out some semi-optimal solutions to real-life<br />
scientific and business <strong>Grid</strong> applications<br />
• Internet datamining for security control and for the guarantee<br />
<strong>of</strong> the Quality-<strong>of</strong>-Service in real-life <strong>Grid</strong> applications –<br />
Interoperability between wired and wireless <strong>Grid</strong>s is also a<br />
very hot issue.<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
33<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
34<br />
Recent Papers or Reports :<br />
1. K. Hwang, S. Song, and J. Lv, “ <strong>Grid</strong>Sec: <strong>Grid</strong> Security Enforcement with<br />
Trust Integration over Minimal VPN Tunnels”, USC Technical Report 2004 –13,<br />
IEEE Computer Magazine, submitted July 2004.<br />
2. S. Song, K. Hwang, and M. Macwan, “Fuzzy Trust Integration for Security<br />
Enforcement in <strong>Grid</strong> <strong>Computing</strong>”, Proc. <strong>of</strong> NPC 2004, Wuhan, China,<br />
October 18, 2004<br />
3. M. Qin and K. Hwang, “Frequent Episode Rules for Internet Traffic Analysis<br />
and Anomaly Detection”, IEEE Network <strong>Computing</strong> and Application Symp.<br />
(NCA-2004), Cambridge, MA. August 31, 2004<br />
4. K. Hwang, H. Liu, Y. Chen, and M.Qin,“ Protecting Network-Centric Systems<br />
with Joint Anomaly/Intrusion Detection over Internet Episodes”, USC<br />
Technical Report 2004 –17, submitted to IPDPS 2005, Oct.8, 2004<br />
Questions or Taking the C<strong>of</strong>fee Break <br />
5. S. Song, R. Kwok, and K. Hwang, “ Trusted Job Scheduling in Open<br />
Computational <strong>Grid</strong>s: Security-Driven Heuristics and A Fast Genetic<br />
Algorithm”, USC Technical Report 2004 –18, submitted to IPDPS 2005, Oct.8,<br />
2004<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
35<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
36<br />
Keynote Presentation at the IFIP International Conference on Network and Parallel <strong>Computing</strong>,<br />
(NPC 2004), Wuhan, China, Oct. 18, 2004 6