A Novel Intrusion Tolerant System Based on Adaptive Recovery Scheme (ARS)

Nowadays, as many information systems are connected to Internet and provide useful services to people through Internet, this openness makes the systems as targets of attackers. Even though conventional security solutions such as intrusion detection system (IDS) or firewall were designed to protect such attacks, it is impossible to block all the attacks. The researches on intrusion tolerant system (ITS) have been conducted in order to keep the proper services in the threatening environments. In this paper, we propose a novel Adaptive Recovery Scheme (ARS) which can be applied to intrusion tolerant architecture. ARS has proactive recovery scheme and reactive recovery scheme including self-recovery and emergency recovery. ARS selects appropriate recovery scheme according to internal and external factors to maintain required security and performance level. Additionally, ARS protects an integrity of critical files through snapshot technology. The performance of ARS is compared with existing recovery-based intrusion tolerant system by CSIM 20.