Dynamic Forensics System with Intrusion Tolerance Based on Hierarchical Coloured Petri-Nets

[[abstract]]In this paper, we propose a dynamic forensics system (DFS) with intrusion tolerance by using Hierarchical Fuzzy Coloured Petri-Nets (HFCPNs), which is utilized to analyze the risk level of the traffic packets received from real server. We improve the intrusion tolerance mechanism [6] by using HFCPNs. When the server is under some threats of intrusion, the malicious packets can be detected by the DFS, and will redirect them to shadow server. By way of using the Coloured Petri Nets and depending on the operator’s experience of fuzzy control, we support more detail design for DFS which can detect more malicious threats than [6]. Therefore, the design of transition will be more flexible for preventing various malicious threats in the DFS