Correlation of system events: High performance classification of selinux activities and scenarios - CaSciModOT (calcul scientifique et modelisation Orleans-Tours) Accéder directement au contenu
Communication Dans Un Congrès Année : 2008

Correlation of system events: High performance classification of selinux activities and scenarios

Résumé

This paper presents an architecture for the characterization and the classification of activities occurring in a computer. These activities are considered from a system point of view, currently dealing with information coming from SELinux system logs. Starting from system events, and following an incremental approach, this paper shows how to characterize high-level and macro activities occuring on the system and how to classify those activities. It gives the formal basics of the approach and presents our implementation. The results of experiments uses real samples taken from our honeypot. Correlation results are obtained using a grid computation. Our high performance architecture enables to compute a large amount of events captured during one year on a high interaction honeypot.
Fichier non déposé

Dates et versions

hal-00459822 , version 1 (25-02-2010)

Identifiants

  • HAL Id : hal-00459822 , version 1

Citer

Jonathan Rouzaud-Cornabas, Patrice Clemente, Christian Toinard. Correlation of system events: High performance classification of selinux activities and scenarios. Workshop on Security and High Performance Computing Systems, Jun 2008, Cyprus, Cyprus. pp.171-177. ⟨hal-00459822⟩
99 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More