MODELING AND EVALUATING THE SURVIVABILITY OF AN INTRUSION TOLERANT DATABASE SYSTEM
Open Access
- Author:
- Wang, Hai
- Graduate Program:
- Information Sciences and Technology
- Degree:
- Doctor of Philosophy
- Document Type:
- Dissertation
- Date of Defense:
- July 02, 2007
- Committee Members:
- Peng Liu, Committee Chair/Co-Chair
C Lee Giles, Committee Member
Dongwon Lee, Committee Member
Akhil Kumar, Committee Member - Keywords:
- Intrusion Tolerance
Survivability
Database Security - Abstract:
- The immaturity of current intrusion detection techniques limits the traditional security systems in surviving malicious attacks. Intrusion tolerance approaches have emerged to overcome these vulnerabilities. Before intrusion tolerance is accepted as an approach to security, there must be quantitative techniques to measure its survivability. However, there are very few attempts to do quantitative, model-based evaluation of the survivability of intrusion tolerant systems, especially in database field. In this thesis, I focus on modeling the survivability of an intrusion tolerant database system in the presence of attacks. Before studying the survivability of intrusion tolerant systems, we need to have a better understanding of the attack behavior and its degree of spreading. Based on the classical epidemic model, a stochastic database damage propagation model is proposed. This model leads to a better understanding and prediction of the scale and speed of database damage propagation. To study the survivability, the intrusion tolerant database system is modeled as a series of state transition models. Based on the Continuous Time Markov Chain (CTMC) and semi-Markov models, quantitative measures are proposed to characterize the capability of a resilient database system surviving intrusions. These facilitate a systematic evaluation to capture the survivability of intrusion tolerant database systems and the impact of system deficiencies on it. An Intrusion Tolerant DataBase system (ITDB) is studied as an example. My experiment results validate the proposed CTMC and semi-Markov models. Survivability evaluation is conducted to study the impact of attack intensity and different system deficiencies on system survivability. The impact of intrusion tolerance operations on performance is also evaluated using the TPC-C benchmark. The performance measurements show that ITDB system is cost-effective within reasonable False Alarm Rates and Detection Latencies range.