Computer Science Department
School of Computer Science, Carnegie Mellon University
Storage-based Intrusion Detection:
Watching Storage Activity for Suspicious Behavior
Adam G. Pennington, John D. Strunk, John Linwood Griffin,
Craig A.N. Soules, Garth R. Goodson, Gregory R. Ganger
October 2002
CMU-CS-02-179.ps
CMU-CS-02-179.pdf
Storage-based intrusion detection allows storage systems to transparently
watch for suspicious activity. Storage systems are well-positioned to spot
several common intruder actions, such as adding backdoors, inserting Trojan
horses, and tampering with audit logs. Further, an intrusion detection
system (IDS) embedded in a storage device continues to operate even after
client systems are compromised. This paper describes a number of specific
warning signs visible at the storage interface. It describes and evaluates
a storage IDS, embedded in an NFS server, demonstrating both feasibility
and efficiency of storage-based intrusion detection. In particular, both
the performance overhead and memory required (40 KB for a reasonable set
of rules) are minimal. With small extensions, storage IDSs can also be
embedded in block-based storage devices.
22 pages
Return to:
SCS Technical Report Collection This page maintained by reports@cs.cmu.edu
School of Computer Science homepage