SOS-WS Host Shield: A sketch-based Service Oriented Shield against web application business layer IDS attacks

Abstract

The Intrusion Detection Systems (IDS) is becoming important and pretty time/space consuming due to the rising level of explosive data flood. All through the past decades, there have been plenty of studies propose software mechanism to take advantage of the temporal locality in the IDS systems. Yet, it require substantial memory block to accumulate the redundancy table. As a result the performance as well as the memory consumption is still value pursuing. To tackle the above weak point, in this paper, we present SOS (Service Oriented Shield) Host Shield, which explore the guard for business layer against IDS Attack. The SOS Web Shield supports Host based HTTPS protection system. The SOS Host Shield includes 3 stages, one is Generalized Patch-based IDS Verifier, and next one is Service Oriented Hash-based support and finally SOS of IntruXML. The SOS Host Shield create virtualized prevent system for host based IDS. This improves the effectiveness of SOS Host shield by avoid the attack in HTTPs of malicious user at hosts. We developed a prototype of SOS Host shield and watchfully evaluate its efficiency using real attack data collected from a large-scale web cluster.