Intrusion Detection and Protection of Application Servers

The protection of application servers using intrusion detection andother related techniques is studied in this thesis. A thorough reviewis first made of taxonomies for intrusion detectionsystems (IDSs) and how these can help to understand the basicfunctionality and problems of intrusion detection. A lightweight IDSwith a number of interesting features has been developed and tested inreal-life situations. I have also studied the consequences of letting such a toolbe integrated into an application server rather than keeping it separate fromthe monitored application, as is common in traditional host-based ornetwork-based systems. Integration enables severaladvantages, such as the ability to monitor encrypted transactions, anAchilles\u27 heel in traditional systems. I also studied a number of extensions andfurther developments to intrusion detection. I have developed an intrusiontolerant architecture that not only detects intrusions butalso provides a means to tolerate them with a graceful degradation ofthe offered service. The intrusion tolerance is achieved byleveraging methods from thefault-tolerant community. Finally, I suggest a method forfacilitating the set-up and training of IDSs based on active learningalgorithms. Considerable performance improvements canbe achieved in this way, as shown in the experiments done in this work