CIDRE Research team
Confidentialité, Intégrité, Disponibilité et Répartition
- Leader : Christophe Bidan
- Type : Project team
- Research center(s) : Rennes
- Field : Algorithmics, Programming, Software and Architecture
- Theme : Security and Confidentiality
- Partner(s) : CNRS,Université Rennes 1,CentraleSupélec
- Collaborator(s) : Institut de recherche en informatique et systèmes aléatoires (IRISA) (UMR6074)
For many aspects of our everyday life, we heavily rely on information systems, many of which are based on massively networked devices that support a population of interacting and cooperating entities. While these information systems become increasingly open and complex, accidental and intentional failures get considerably more frequent and severe.
Two research communities traditionally address the concern of accidental and intentional failures: the distributed computing community and the security community. While both these communities are interested in the construction of systems that are correct and secure, an ideological gap and a lack of communication exist between them that is often explained by the incompatibility of the assumptions each of them traditionally makes. Furthermore, in terms of objectives, the distributed computing community has favored systems availability while the security community has focused on integrity and confidentiality, and more recently on privacy.
Our long term ambition is to contribute to the building of distributed systems that are trustworthy and respectful of privacy, even when some nodes in the system have been compromised. For that purpose, we are convinced that combining classical security approaches and distributed computing paradigms is an interesting way to enforce the security of large-scale distributed systems. More specifically, since a distributed system is composed of nodes, we assert that the security of large-scale distributed systems has to be addressed at three complementary levels:
- the level of each node: each standalone node has to enforce its own security;
- the level of an identified set of trusted nodes: the trusted nodes can collaborate to enforce together their security;
- the level of fully open large-scale distributed and dynamic systems: distributed computing paradigms such as consensus algorithms can be applied to cope with the possible presence of malicious nodes.
Notice that using a distributed architecture can also be an approach allowing the nodes to enforce their security without the need of a trusted third party.
The research activities of the CIDRE project-team focus mainly on the two following research axis:
Intrusion Detection System: the objective is to detect any suspicious events with regard to the security by analyzing some data generated on the monitored system.
Privacy-preserving Services: the objective is to ensure users’ privacy even when this property seems incompatible with the provided services, like social networks or location-based services.
In all our studies, we consider a priori that the attacker is omnipotent. He can acts as he wants. Nevertheless, being not a team specialized in cryptography, we consider that we can rely on strong unbroken cryto-systems.
The research activities of the CIDRE project-team focus mainly on the two following research axis:
- Intrusion Detection System: the objective is to detect any suspicious events with regard to the security by analyzing some data generated on the monitored system.
- Privacy-preserving Services: the objective is to ensure users’ privacy even when this property seems incompatible with the provided services, like social networks or location-based services.
Intrusion Detection / Security Events Monitoring and Management
Today, we are not yet fully entered into a world of “security by design”. Security remains often a property that is considered a posteriori, when the system is deployed, which often results in applying patches when vulnerabilities are discovered (also called a “patch and pray” approach). Unfortunately, despite patching, the number of vulnerabilities remains high, as evidenced by the number of vulnerabilities published each year in the Common Vulnerabilities and Exposures (CVE) system. Thus, it is important to be able to early detect cyber-attacks, especially when they exploit vulnerabilities that are unknown. However, the efficiency of security events monitoring and management systems (including the IDS - Intrusion Detection Systems) is still an open issue today. Indeed, they are often unable to effectively deal with huge numbers of security events, and they usually produce too many false alarms yet missing some attacks. So one of the main research challenges in IT security remains the definition of efficient security events monitoring systems, i.e., that enable both to process a huge number of security events and to detect any attacks without flooding the security analysts with false alarms.
By exploiting vulnerabilities in operating systems, applications, or network services, an attacker can defeat preventive security mechanisms and violate the security policy of the whole system. The goal of an Intrusion Detection Systems (IDS) is to detect such violations by analyzing some security events generated on a monitored system. Ideally, the IDS should produce an alert for any violation (no false negative), and only for violations (no false positive).
To produce alerts, two detection techniques exist: the misuse based detection and the anomaly based detection. A misuse based detection is actually a signature based detection approach : it allows to detect only the attacks whose signature is available. From our point of view, while useful in practice, misuse detection is intrinsically limited. Indeed, it requires to update in real-time the database of signatures, similarly to what has to be done for antivirus tools. The CIDRE project-team follows the alternative approach, namely the anomaly approach, which consists in detecting a deviation from a referenced behavior. Our contributions on anomaly-based IDS follow three axis:
- Illegal Information Flow Detection: our goal is to detect information flows in the monitored system (either a node or a set of trusted nodes) that are allowed by the access control mechanism, but are illegal from the security policy point of view. This approach is particularly appealing to detect intrusions in a standalone node, such as a smartphone.
- Anomaly-Based Detection in Distributed Applications: our goal is to specify the normal behavior based on either a formal specification of the distributed application, or previous executions. This approach is particularly appealing to detect intrusions in industrial control systems since these systems exhibit well-defined behaviors at different levels: network level (network communication patterns, protocol specifications, etc.), control level (continue and discrete process control laws), or even the state of the local resources (memory or CPU).
- Online data analytics: our goal is to estimate on the fly different statistics or metrics on distributed input streams to detect abnormal behavior with respect to a well-defined criterion such as the distance between different streams, their correlation or their entropy.
Beside the anomaly-based IDS, we have also led research work on alert correlation and visualisation of security events. Indeed, in large systems, multiple (host and network) IDS and many sensors are deployed and they continuously and independently generate notifications (event’s observations, warnings and alerts). To cope with this huge amount of collected data, we have studied two different approaches, each with specific goal:
- Alert Correlation System: the alerts of low level IDSes can be viewed as security events of a high level IDS whose goal is to correlate these alerts. An alert correlation system aims at exploiting the known relationships between some elements that appear in the flow of low level notifications to generate high semantic meta-alerts. The main goal is to reduce the number of alerts (and especially, false positive) returned to the security analysts and to allow a higher level analysis of the situation (situational awareness).
- Visualization Tools: a visualization tools aims at relying on the capacity of human beings to detect patterns and outliers in datasets when these datasets are properly visually represented. Human beings also know pieces of contextual information that are very difficult to formalize so as to make them usable by a computer. Visualization is therefore a very useful complementary tool to detect abnormal events in real time (monitoring), to search for malicious events in log files (data exploration and forensics) and to communicate results (reporting).
In a world of ubiquitous technologies, each individual constantly leaves digital traces related to his activities and interests. The current business plan of many web services such as social networks, is based on the sale of these digital traces. Of course, this is usually done in a legal way, the license of use clearly stating that the user gives the right to the service provider for using his personal data. However, on the one hand, users generally do not read these licenses, and on the other hand, these licenses are usually very vague on the use of personal data. In addition these digital traces can potentially be stolen and maliciously used, they must therefore be protected. In this context, users’ privacy is now recognized as a fundamental individual right. Any new IT service should thus follow the privacy-by-design approach: privacy issues have to be studied from the earliest phase of a project by taking into account the multi-stakeholders and transdisciplinary aspects in order to ensure proper, end-to-end private data protection properties.
In the CIDRE project, we mainly focus on domains in which privacy issues collide with provided services. Here are some concrete examples of such domains:
- Location-based services: the challenge is to design services that depend on the user’s location while preserving the privacy of his location;
- Social networks: the challenge is to demonstrate that it is possible to design social networks respectful of users’ privacy;
- Mobile services: given that such services are based on user’s identity, the challenge is to design mobile services while preserving the users’ anonymity;
- Ad-hoc netwoks: in ad-hoc networks, any participant can potentially know the relative location of the other participants. Thus, the issue is to allow nodes to forward messages while preserving the privacy of the communications.
For all of these domains, we have proposed new Privacy-Enhancing Techniques (PETs) based on a mix of different foundations such as cryptographic techniques, security policies and access control mechanisms, just to name a few. More generally, we think that a major option to protect users’ privacy consists in using a decentralized architecture that enables to transfer control and services from the service providers to the users.
International and industrial relations
Research teams of the same theme :
- COMETE - Concurrency, Mobility and Transactions
- DATASPHERE - Economie des données et des plateformes
- PESTO - Proof techniques for security protocols
- PRIVATICS - Privacy Models, Architectures and Tools for the Information Society
- PROSECCO - Programming securely with cryptography
- TAMIS - Threat Analysis and Mitigation for Information Security