Application-Integrated Data Collection for Security Monitoring

Abstract

This paper describes a new approach to collecting real-time transaction information from a server application and forwarding the data to an intrusion detection system. While the few existing application-based intrusion detection systems tend to read log files, the proposed application-integrated approach uses a module coupled with the application to extract the desired information. The paper describes the advantages of this approach in general, and how it complements traditional network-based and host-based data collection methods. The most compelling benefit is the ability to monitor transactions that are encrypted when transported to the application and therefore not visible to network traffic monitors. Further benefits include full insight into how the application interprets the transaction, and data collection that is independent of network line speed. To evaluate the proposed approach, we designed and implemented a data-collection module for the Apache Web server. Our experiments showed that the required implementation effort was moderate, that existing communication and analysis components could be used without incurring adaptation costs, and that the performance impact on the Web server is tolerable. Keywords: Intrusion detection, application, application-integrated, module, Web server, Apache.

The work described here is currently funded by DARPA/ATO under contract number F30602-99-C-1049 and contract number F30602-98-C-0059. The views herein are those of the author(s) and do not necessarily reflect the views of the supporting agency.