Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

function has a limitation that it depends onservices that are considered [1].The third contribution deals with attackidentification. We consider individual attacksinstead of attack categories. This may help totake some appropriate reactions afterdetection according to the specific attacks. K-Nearest Neighbor (kNN) and PrincipalComponent Analysis (PCA) methods are usedand compared for intrusion detection. KDD 99network data are used for validating the twomethods.The second part of our work in the DADDiproject focuses on the dependability of anintrusion detection architecture based on theimplicit approach. We use an architecture thatensures both confidentiality and integrity atthe COTS server level and we extend it toenhance availability. Replication techniquesimplemented on top of agreement services(based on a consensus protocol) are used toavoid any single point of failure. On the onehand we assume that COTS servers arecomplex softwares that contain somevulnerabilities and thus may exhibit arbitrarybehaviors. While on the other hand other basiccomponents of the proposed architecture aresimple enough to be exhaustively verified [3].We have conducted performance evaluationsto measure the additional cost induced by themechanisms used to ensure the availability ofthe secure architecture. As each HTTP requestinvolves the use of the atomic broadcastservice, its cost had to be carefully evaluated.Moreover, since HTTP requests aresequentially executed, the throughput of theservice can be severly degraded. We aimed atidentifying some of the parameters that mayimpact the cost of the atomic broadcastservice. We measured the mean requestdelivering duration for a fixed arrival frequencyof external requests. We sampled this measurefor a varying number of processes anddifferent consensus round durations. We foundthat the number of processes in the group onlyslightly influences the overall performance ofthe atomic broadcast service. In thisexperiment, the arrival frequency of externalresquests is rather low (one request every400ms). In this case, the consensus roundduration is of limited influence. This parameteris of major influence only when a failureoccurs. In another experiment, we haveconsidered a fixed value for the duration of theconsensus round (1000ms) and we sample themean delivering duration for various arrivalfrequencies of the externam requests and avarying number of processes. We found thatwhen the arrival frequency of requests reachesa critical value, the mean request deliveringduration increases significantly (to bepublished in 2008).ConclusionIn the last period of the project, we haveplanned to apply these new results in explicitand implicit approach to web-based real-lifetraffic to compare and show thecomplementarities of the implicit and explicitapproaches.The web-based traffic has been generated. Itcontains “normal” data, collected with noplayed attack in front of a web serverconnected to Internet. Besides that, attackshave been played directly in front of the webserver. This traffic has been transformed bythe transformation function and will be studiedvery soon.References[1] A. Bsila, S. Gombault and A. Belghith.Improving traffic transformation function todetect novel attacks. SETIT'07: 4thInternational Conference on Sciences ofElectronics, Technologies of Information andTelecommunications, March 25-29,Hammamet, Tunisia, 2007[2] Yacine Bouzida. Application de l’analyse encomposante principale pour la détectiond’intrusion et détection de nouvelles attaquespar apprentissage supervisé. PhD thesis,TELECOM Bretagne, 2006.[3] M. Hurfin, J.-P. Le Narzul, F. Majorczyk, L.Mé, A. Saydane, E. Totel, F. Tronel. ADependable Intrusion Detection ArchitectureBased on Agreement Services. InternationalSymposium on Stabilization, Safety andSecurity of Distributed Systems. November17 th -19 Th , 2006. Dallas (Texas, USA).[4] Wei Wang, Sylvain Gombault and AmineBsila. Building multiple behavioral models fornetwork intrusion detection. 2nd IEEEWorkshop on "Monitoring, Attack Detectionand Mitigation", Toulouse, France, November2007.46 Extract of Pracom’s Annual Report 2008