A tamper resistant Intrusion Detection System

This book describes the implementation of a tamper resistant intrusion detection system that monitors security properties at architectural level. In our system model we assume to have a black-box-component-based application where all components run concurrently and interact with each other exchanging messages. A message encodes information about the type of communication, i.e. a request or a reply, the kind of service, its parameters and the (returned) data. Our tool takes as an input a specification describing the component based application in terms of the messages requested/accepted by the components, and a formal specification of the components messages exchage. Given the above specification the DESERT tool generates a set of filters specifications that are assigned one for each component of the system. Our main purpose is to implement a set of utilities that given a filter specification generate its CORBA implementation. Therefore, we assume that the components communicate by means of the CORBA middleware. Finally, we validate our implementation by means of a real case study.