ABSTRACT Because attacks are becoming more frequent and more complex, intrusion detection systems (IDSes) need significant improvements to be able to detect new attacks and variants of already known attacks. It is thus necessary to assess precisely their quality of detection, performance, and robustness in the environment where they will be deployed. In this paper, we present an evaluation approach designed to overcome most of the identified weaknesses in several IDS evaluation: the lack of a rigorous methodology, the use of non‐representative test datasets, and the use of inappropriate metrics. In our approach, model‐based evaluation is combined with experimental testing. Because testing an IDS against all possible attacks is practically impossible, we propose a classification of elementary attacks and a model of attack processes. Then, we developed the attack planning and injection tool that helps security administrators to plan and select the most relevant attack scenarios. Attack planning and injection tool is able to generate and carry out concrete and adaptable attacks on specifically identified computers. To demonstrate the validity of our approach, we experimented our tool in a case study environment to compare well‐known IDSes. Copyright © 2013 John Wiley & Sons, Ltd.

Nowadays, more and more information systems are connected to the Internet and offer Web interfaces to the general public or to a restricted set of users. Such openness makes them likely targets for intruders, and conventional protection techniques have been shown insufficient to prevent all intrusions in such open systems. This paper proposes a generic architecture to implement intrusion-tolerant Web servers. This architecture is based on redundancy and diversification principles in order to increase the system resilience to attacks: usually, an attack targets a particular software, running on a particular platform, and fails on others. The architecture is composed of redundant proxies that mediate client requests to a redundant bank of diversified application servers. The redundancy is deployed here to increase system availability and integrity. To improve performance, adaptive redundancy is applied: the redundancy level is selected according to the current alert level. The architecture can be used for static servers, that is, for Web distribution of stable information (updated offline) and for fully dynamic systems where information updates are executed immediately on an online database. The feasibility of this architecture has been demonstrated by implementing an example of a travel agency Web server, and the first performance tests are satisfactory, both for request execution times and recovery after incidents.

Collaboration allows sharing, processing and exchanging large amounts of data between individuals as well as groups and organizations. In this context, security and access control are important issues that should be studied, specified and enforced. In this paper, we discuss the different approaches that address access control for cooperative systems while putting emphasis on some important proposals; we conclude with a comparison between some interesting approaches, and we introduce some perspectives that help developing the domain.

With the massive surges of new malware, the intuitive detection techniques currently used in most security tools deem ineffective. Consequently, we urgently need better solutions that are established on solid theoretical basis. It becomes, thus, necessary to search for more efficient techniques and algorithms as well as taxonomies and models for attacks and malware. We present, in this paper, the analysis we made on both automatic malware and human-centric attacks, which allowed us to construct a model for attack process. The main objective of this work is to construct a model that can aide in the generation of real attack scenarios and use it in the evaluation of Intrusion Detection Systems. However, the model described here could have many other potential uses. For example, it can be used for writing "execution- based" signatures, event correlation, penetration testing, security simulations as well as security educations.

Checking data possession in networked information systems such as those related to critical infrastructures (power facilities, airports, data vaults, defense systems, etc.) is a matter of crucial importance. Remote data possession checking protocols permit to check that a remote server can access an uncorrupted file in such a way that the verifier does not need to know beforehand the entire file that is being verified. Unfortunately, current protocols only allow a limited number of successive verifications or are impractical from the computational point of view. In this paper, we present a new remote data possession checking protocol such that: i) it allows an unlimited number of file integrity verifications; ii) its maximum running time can be chosen at set-up time and traded off against storage at the verifier.

Among all the security issues in Voice over IP (VoIP) communications, one of the most difficult to achieve is traffic analysis resistance. Indeed, classical approaches provide a reasonable degree of security but induce large round-trip times that are incompatible with VoIP. In this paper, we describe some of the privacy and security issues derived from traffic analysis in VoIP. We also give an overview of how to provide low-latency VoIP communication with strong resistance to traffic analysis. Finally, we present a server which can provide such resistance to hundreds of users even if the server is compromised.

Nowadays, systems are more and more open, distributed and collaborative. In this context, access control is an important issue that should be studied, specified and well enforced. This work proposes a new access control model for collaborative systems: "PolyOrBAC". On the one hand, we extend OrBAC (organization-based access control model) to specify local as well as collaboration access control rules; on the other hand, we enforce these security policies by applying Web services mechanisms (XML, SOAP, UDDI and WSDL). Then, we present a representative scenario of secure collaborative applications. Furthermore, we propose a XACML-based implementation of PolyOrBAC and we discuss the most important approaches that emphasize access control in collaborative environments.

Current systems providing anonymous communication with low latency are based on relay-networks. Since a single relay can betray its users, it is necessary to use several relays for each communication which distributes the trust among them. This increases the complexity of the protocols as well as the latency, and lowers the throughput to the one of the worst link used. On the other side, such distributed systems are more difficult to attack and can manage large sets of users. In this paper, we proposed a non-distributed approach by presenting the first relay for anonymous communication that cannot betray its users, the pMIX. The scalability for this relay is reduced as the computational cost grows in O(n2) (n being the number of users connected to it) and therefore pMIXes can only be used to form small anonymity sets. In this paper we present different variants for the pMIX that lower the computational cost either to O(ntimesm) or to O(m2) (m being the number of simultaneous communications). This allows a pMIX to deal with larger groups of users having a small amount of simultaneous communications

The Internet has become essential to most enterprises and many private individuals. However, both the network and computer systems connected to it are still too vulnerable and attacks are becoming evermore frequent. To face this situation, traditional security techniques are insufficient and fault-tolerance techniques are becoming increasingly cost-effective. Nevertheless,intrusions are very special faults, and this has to be taken into account when selecting the fault-tolerance techniques.

Privacy is extremely important in healthcare systems. Unfortunately, most of the solutions already deployed are developed empirically. After discussing some of such existing solutions, this paper describes an analytic and generic approach to protect personal data by anonymization. This approach is then applied to some representative scenarios. The architecture and its implementation with a JavaCard are finally presented. Our analysis, solution and implementation are generic enough to be adapted to various collaborative systems that process sensitive data such as e-commerce, e-government, social applications, etc

MIXes are routers that accept packets until their buffers are full, and then send them to the recipients hiding the link (usually through reencryption and rearrangement) between incoming and outgoing packets. MIXes and their variants are used today to provide untraceable communication with systems such as TOR, and they have been a major issue of research on privacy protection for more than twenty years. One of the major problems presented by a MIX is that its administrator is able to link the incoming and outgoing messages transiting through it, and this is the reason why MIXes are almost always organized in networks, according to the model presented by David Chaum (1981). In this paper, we present a protocol that combines these two fields of research, allowing us to create MIXes that have the remarkable property of being unable to link the incoming and outgoing packets transiting through them. This brings the possibility for its users to be untraceable while most of the data of their communication are sent through a single MIX, improving the performance and versatility of anonymizing systems

The Internet has become essential to most enterprises and many private individuals. However, both the network and computer systems connected to it are still too vulnerable and attacks are becoming evermore frequent. To face this situation, traditional security techniques are insufficient and fault tolerance techniques are becoming increasingly cost-effective. Nevertheless, intrusions are very special faults, and this has to be taken into account when selecting the fault tolerance techniques.

This paper presents the results of an experiment in security evaluation. The system is modeled as a privilege graph that exhibits its security vulnerabilities. Quantitative measures that estimate the effort an attacker might expend to exploit these vulnerabilities to defeat the system security objectives are proposed. A set of tools has been developed to compute such measures and has been used in an experiment to monitor a large real system for nearly two years. The experimental results are presented and the validity of the measures is discussed. Finally, the practical usefulness of such tools for operational security monitoring is shown and a comparison with other existing approaches is given.

Addresses the problem of distributed object system protection. A new authorization scheme is presented and described, based on the collaboration between a central authorization server and security kernels located on each site of the system. A novel approach to access rights management for such an architecture is detailed, based on a new kind of access rights and a new scheme of privilege delegation. This authorization scheme can be adapted to various security policies, including multilevel policies such as that of Bell & LaPadula (1975). An extension of the Bell-LaPadula model to distributed object systems is presented and its implementation using the authorization scheme is described.

An intrusion-tolerant distributed system is a system which is designed so that any intrusion into a part of the system will not endanger confidentiality, integrity and availability. This approach is suitable for distributed systems, because distribution enables isolation of elements so that an intrusion gives physical access to only a part of the system. In particular, the intrusion-tolerant authentication and authorization servers enable a consistent security policy to be implemented on a set of heterogeneous, untrusted sites, administered by untrusted (but nonconspiring) people. The authors describe how some functions of distributed systems can be designed to tolerate intrusions. A prototype of the persistent file server presented has been successfully developed and implemented as part of the Delta-4 project of the European ESPRIT program.>

The consequences of faults and intrusions in computer networks are of ever-increasing importance; new efficient techniques are needed to deal with them. The SATURNE [DES 86] project aims at solutions for architectures based on the concept of fault- and intrusion-tolerance rather than avoidance techniques. The subject of the paper concerns the security of files. Files are partitioned and then fragmented before being stored in different, distributed archive sites in order to tolerate intrusions into some of these sites. The choice among different fragmentation cryptographic methods is discussed, related to different kinds of possible attacks. A simple and fast solution is proposed that nevertheless ensures a high level of file security and authenticity.