This paper reports a method of protection against zero-day attacks using SandBox technology based on the developed analytical model with a probabilistic ranking of information system states. The model takes into consideration the conditions of a priori uncertainty regarding the parameters of the destructive flow on the system, accounting for the typical procedures of the network SandBox.
The proposed model of information system states makes it possible to analyze and track all possible states, as well as assess the level of security in these states, and the probability of transitions into them. Thus, it is possible to identify the most dangerous ones and track the activities that caused the corresponding changes. The fundamental difference between this model and standard approaches is the weight coefficients that characterize not the intensity of random events but the intensity of transitions between states.
Direct implementation and application of the proposed analytical model involved the technology of multilevel network "SandBoxes".
The difference from other popular anti-virus tools is the use of a priori mathematical threat assessment, which makes it possible to detect influences that are not considered threats by classical systems until the moment of harm to the system.
The combination with standard security tools makes it possible to separately analyze files that are too large in size, whether they enter the system not through a common gateway controlled by the network "SandBox" but from the external media of end-users.
The implementation of the developed analytical model has made it possible to improve the level of protection of the corporate network by 15 %, based on the number of detected threats. This difference is explained by the inability of classical software to detect new threats if they are not already listed in the database of the program, and their activity is not trivial

/pdf/devising-a-method-of-protection-against-zero-day-attacks-2sp3ls3gek.pdf

Devising a method of protection against zero-day attacks based on an analytical model of changing the state of the network sandbox

There is a significant body of research on distributed computing architectures, methodologies and algorithms, both in the fields of fault tolerance and security Whilst they have taken separate paths until recently, the problems to be solved are of similar nature In classical dependability, fault tolerance has been the workhorse of many solutions Classical security-related work has on the other hand privileged, with few exceptions, intrusion prevention Intrusion tolerance (IT) is a new approach that has slowly emerged during the past decade, and gained impressive momentum recently Instead of trying to prevent every single intrusion, these are allowed, but tolerated: the system triggers mechanisms that prevent the intrusion from generating a system security failure The paper describes the fundamental concepts behind IT, tracing their connection with classical fault tolerance and security We discuss the main strategies and mechanisms for architecting IT systems, and report on recent advances on distributed IT system architectures

Intrusion-Tolerant Architectures: Concepts and Design.

Tremendous efforts have been taken over many years to secure the network against attacks; still attackers are successful with painful frequency. Experienced attackers try to disable the Intrusion Detection System (IDS) before launching attack. Therefore there should be some mechanism in IDS for uninterrupted detection of intrusion even though failure in IDS has occurred due to attacks. This paper presents the design and implementation of Novel Intrusion-Tolerant Distributed Intrusion Detection System using Packet Filter Firewall and State Transition Tables. Proposed architecture is immune to both, failure of IDS components and compromised IDS components. This architecture is capable of restricting the effect of network attacks like DoS, DDoS and Probing to a subset of network. Experimental results prove the usefulness and efficiency of this architecture.

/pdf/novel-architecture-for-intrusion-tolerant-distributed-1nuar2dhf1.pdf

Novel Architecture for Intrusion-Tolerant Distributed Intrusion Detection System using Packet Filter Firewall and State Transition Tables

One of the most advanced research issues in network security is intrusion-tolerant intrusion detection, which has become another essential technique to protect computer systems and prevent the intrusion from generating a system failure. This paper presents a novel intrusion-tolerant intrusion detection method based on real-time sequence forecast analysis for network stream. We devise linear regression techniques to forecast network stream sequences. According to these, it's helpful for us to analysis intruders' behaviors and to recognize undesirable intrusions. We also provide recovery strategies to tolerate intrusion. Experiments on the http server demonstrate that our method outperform the others.

An Intrusion-Tolerant Intrusion Detection Method Based on Real-Time Sequence Analysis

Handle everyday research tasks with reliable, citation-backed results

Your personal Research Agent to handle research tasks with citation-backed results

Popular Tasks used by Researchers

How can I help with your research?

Meet SciSpace

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Li Jin

Author Tools

Chat about Author

Papers

An Intrusion-Tolerant Intrusion Detection Method Based on Real-Time Sequence Analysis