Attack resistant continuous network service trustworthiness controller

• US 8,572,735 B2
• Filed: 03/31/2008
• Issued: 10/29/2013
• Est. Priority Date: 03/29/2007
• Status: Active Grant

• Current Assignee: George Mason Research Foundation Inc.
• Original Assignee: George Mason Research Foundation Inc.
• Inventors: Ghosh, Anup K., Huang, Yih, Sood, Arun
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): DOAN, TRANG T
• Application Number:
  US12/059,454
• Publication Number:
  US 20090044265A1
• Time in Patent Office: 2,038 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An attack resistant continuous network service trustworthiness controller comprising: state estimation module(s), response selection module(s), actuation module(s), and client dispatcher communication module(s) for maintaining the availability and integrity of online server(s). The state estimation module(s) are configured to generate state estimate(s) for online server(s) using behavior data obtained using sensor module(s). The response selection module(s) are configured to determine corrective action(s) to maintain the availability and integrity of online server(s) when state estimate(s) indicate that the integrity of an online server(s) is compromised. The actuation module(s) are configured to activate actuator(s) based upon the corrective action(s). Client dispatcher communication module(s) are configured to communicate online server availability information to a client dispatcher.

Claims

1. A trustworthiness controller comprising:

a. a sensor module configured to collect behavior data for at least one online server;

b. at least one state estimation module configured to generate at least one state estimate for at least one of the at least one online server using the behavior data;

c. at least one response selection module configured to determine at least one selected response to maintain an availability and an integrity of at least one of the at least one online server when at least one of the at least one state estimate indicates that the integrity of at least one of the at least one online server is compromised;

d. at least one actuation module configured to activate at least one actuator based upon at least one of the at least one selected response; and

e. a client dispatcher communication module configured to communicate online server availability information to a client dispatcher;

f. wherein;

i. at least one of said at least one online server is a virtual online server; and

ii. said trustworthiness controller employs one or more processors.

2. The trustworthiness controller according to claim 1, wherein said sensor module includes at least one of the following:

a. an intrusion sensing module configured to detect an external intrusion in at least one of the at least one online server;

b. an integrity monitoring module configured to detect an unauthorized change to at least one of the at least one online server;

c. an anomaly detection module configured to detect behavior by at least one of the at least one online server that is indicative of an intrusion;

d. a performance monitoring module configured to detect an unpredicted decrease in performance of at least one of the at least one online server;

e. an exposure timer module configured to limit a window of vulnerability to at least one of the at least one online server;

f. a sensor observation module configured to collect observation data from at least one of the at least one online server;

or

g. any combination thereof.

3. The trustworthiness controller according to claim 1, wherein the state estimation module uses at least one of the following:

a. a rule-based estimation module configured to influence at least one of the at least one state estimate using a rule that evaluates behavior data of at least one of the at least one online server;

b. a stochastic control module configured to influence at least one of the at least one state estimate using current behavior data and historical behavior data of at least one of the at least one online server;

c. a Bayes Net module configured to influence at least one of the at least one state estimate using current behavior data conditioned on prior behavior data of at least one of the at least one online server;

or

d. any combination thereof.

4. The trustworthiness controller according to claim 1, wherein the actuator module facilitates at least one of the following:

a. a server restart module configured to terminate and restart a server;

b. a server reversion module configured to revert a virtual machine to a predetermined state;

c. a client request throttling module configured to throttle client requests;

d. a blocking module configured to block client requests;

or

e. any combination thereof.

5. The trustworthiness controller according to claim 1, wherein said at least two of the at least one online server are on different physical servers.

6. The trustworthiness controller according to claim 1, further including:

a. an incoming communications module configured to receive instructions from a higher level controller, the higher level controller configured to manage a multitude of trustworthiness controllers; and

b. an outgoing communication module configured to communicate summary reports to the higher level controller.

7. A trustworthy network server system comprising:

a. at least one hardware server configured to host at least one virtual machine;

b. at least one virtual server residing on at least one of the at least one virtual machine;

c. a client dispatch module configured to;

i. maintain a list of available virtual servers, at least one of the available virtual servers being one of the at least one virtual server; and

ii. route at least one client request to at least one of the available servers listed on the list of available virtual servers;

d. at least one virtual machine monitor configured to manage at least one of the at least one virtual machine; and

e. at least one trustworthiness controller module including;

i. a sensor module configured to collect behavior data for at least one of the at least one online server;

ii. at least one state estimation module configured to generate at least one state estimate for at least one of the at least one online server using the behavior data;

iii. at least one response selection module configured to determine at least one selected response to maintain an availability and an integrity of at least one of the at least one online server when at least one of the at least one state estimate indicates that the integrity of at least one of the at least one online server is compromised;

iv. at least one actuation module configured to activate at least one actuator based upon at least one of the at least one selected response; and

v. a client dispatcher communication module configured to communicate online server availability information to a client dispatcher.

8. The trustworthy network server system according to claim 7, wherein the client dispatcher is a load balancer.

9. The trustworthy network server system according to claim 7, wherein at least one of the at least one virtual machine manager is configured to:

a. create a pool of the at least one virtual machine; and

b. execute at least one instruction from at least one of the at least one trustworthiness controller module.

10. The system according to claim 7, wherein at least one of the at least one sensor module includes at least one of the following:

a. an intrusion sensing module configured to detect an external intrusion in at least one of the at least one online server;

b. an integrity monitoring module configured to detect an unauthorized change to at least one of the at least one online server;

c. an anomaly detection module configured to detect behavior by at least one of the at least one online server that is indicative of an intrusion;

d. a performance monitoring module configured to detect an unpredicted decrease in performance of at least one of the at least one online server;

e. an exposure timer module configured to limit a window of vulnerability to at least one of the at least one online server;

f. a sensor observation module configured to collect observation data from at least one of the at least one online server;

or

g. any combination thereof.

11. The system according to claim 7, wherein at least one of the at least one state estimation module includes at least one of the following:

a. a rule-based estimation module configured to influence at least one of the at least one state estimate using a rule that evaluates behavior data of at least one of the at least one online server;

b. a stochastic control module configured to influence at least one of the at least one state estimate using current behavior data and historical behavior data of at least one of the at least one online server;

c. a Bayes Net module configured to influence at least one of the at least one state estimate using current behavior data conditioned on prior behavior data of at least one of the at least one online server;

or

d. any combination thereof.

12. The system according to claim 7, wherein at least one of the at least one actuator includes at least one of the following:

a. a server restart module configured to terminate and restart a server;

b. a server reversion module configured to revert a virtual machine to a predetermined state;

c. a client request throttling module configured to throttle client requests;

d. a blocking module configured to block client requests ;

or

e. any combination thereof.

13. The system according to claim 7, wherein at least one of the at least one virtual server is a single-purpose application server.

14. A non-transitory computer-readable media tangibly embodying a program of instructions executable by a computer to perform a method for maintaining an availability and an integrity of at least one virtual server, the method comprising:

a. generating a state estimate for at least one of the at least one virtual server using behavior data obtained using at least one sensor module;

b. determining at least one selected response to maintain the availability and the integrity of at least one of the at least one virtual server when the state estimate indicates that the integrity of at least one of the at least virtual server is compromised;

c. activating at least one actuator based upon at least one of the at least one selected response; and

d. communicating virtual server availability information to a client dispatcher module, the client dispatcher module configured to route client requests to at least one selected at least one virtual server.

15. The non-transitory computer-readable media according to claim 14, wherein the client dispatcher module is further configured to maintain a list of available at least one virtual server.

16. The non-transitory computer-readable media according to claim 14, wherein at least one of the at least one sensor module is configured to perform at least one of the following actions:

a. detecting an external intrusion in at least one of the at least one virtual server;

b. detecting an unauthorized change to at least one of the at least one online server;

c. detecting behavior by at least one of the at least one online server that is indicative of an intrusion;

d. detecting an unpredicted decrease in at least one of the at least one online server;

e. limiting a window of vulnerability to at least one of the at least one online server;

or

f. a combination of the above.

17. The non-transitory computer-readable media according to claim 14, wherein the state estimate is generated using at least one of the following:

a. a rule-based estimation module configured to influence at least one of the at least one state estimate using a rule that evaluates behavior data of at least one of the at least one online server;

b. a stochastic control module configured to influence at least one of the at least one state estimate using current behavior data and historical behavior data of at least one of the at least one online server;

c. a Bayes Net module configured to influence at least one of the at least one state estimate using current behavior data conditioned on prior behavior data of at least one of the at least one online server;

or

d. any combination thereof.

18. The non-transitory computer-readable media according to claim 14, wherein at least one of the at least one actuator is configured to perform at least one of the following actions:

a. terminate and restart a server;

b. revert a virtual machine to a predetermined state;

c. throttle client requests;

d. block client requests;

or

e. any combination thereof.

19. The non-transitory computer-readable media according to claim 14, further including:

a. receiving instructions from a higher level controller, the higher level controller configured to manage a multitude of trustworthiness controllers; and

b. communicating summary reports to the higher level controller.