Skip to main content
SpringerLink
Log in
Book cover

Innovations and Advanced Techniques in Computer and Information Sciences and Engineering pp 273–278Cite as

An Aspect-Oriented Model to Monitor Misuse

  • Conference paper

Abstract

The efficacy of the aspect-oriented paradigm has been well established within several areas of software security as aspect-orientation facilitates the abstraction of these security-related tasks to reduce code complexity. The aim of this paper is to demonstrate that aspect-orientation may be used to monitor the information flows between objects in a system for the purposes of misuse detection. Misuse detection involves identifying behavior that is close to some previously defined pattern signature of a known intrusion.

Keywords

  • Information Flow
  • Intrusion Detection
  • Security Policy
  • Anomaly Detection
  • Misuse Detection

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   129.00
Price excludes VAT (Canada)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   169.99
Price excludes VAT (Canada)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD   169.99
Price excludes VAT (Canada)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. B. De Win, B. Vanhaute and B. Decker, “Security through Aspect-Oriented Programming,” in Advances in Network and Distributed Systems Security, IFIP TC11 WG11.4 First Working Conference on Network Security, November 2001, pp.125-138.

    Google Scholar 

  2. D. Xu and K. Nygard, “A Threat-Driven Approach to Modeling and Verifying Secure Software,” in Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, November 2005, pp.342-346.

    Google Scholar 

  3. J. Newsome and D. Song, “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software,” in 12th Annual Network and Distributed System Security Symposium, February 2005, pp.1-17.

    Google Scholar 

  4. P. Falcarin, M. Baldi and D. Mazzochi, “Software Tampering Detection Using AOP and Mobile Code,” presented at International Conference on Aspect-Oriented Software Development (AOSD’04), Lancaster, UK, 2004.

    Google Scholar 

  5. G. Boström, “A Case Study on Estimating the Software Engineering Properties of Implementing Database Encryption as an Aspect,” presented at Proceedings of the 3rd international conference on Aspect-oriented software development, Lancaster, UK, 2004.

    Google Scholar 

  6. B. De Win, W. Joosen and F. Piessens, “Aosd Security: A Practical Assessment,” presented at Workshop on Software engineering Properties of Languages for Aspect Technologies (SPLAT03), Boston, Massachusetts, 2003.

    Google Scholar 

  7. B. Vanhaute and B. De Win, “AOP, Security and Genericity,” presented at 1st Belgian AOSD Workshop, Vrije Universiteit Brussel, Brussels, Belgium, 2001.

    Google Scholar 

  8. J.P. Choi, “Aspect-Oriented Programming with Enterprise Javabeans,” in Fourth International Enterprise Distributed Object Computing Conference (EDOC’00), September 2000, pp.252-261.

    Google Scholar 

  9. N. Ubayashi, H. Masuhara and T. Tamai, “An AOP Implementation Framework for Extending Joint Point Models,” presented at ECOOP’ 2004 Workshop on Reflection, AOP and Meta-Data for Software Evolution, Oslo, Norway, 2004.

    Google Scholar 

  10. R.A.V. Kemmerer, G., “Intrusion Detection: A Brief History and Overview,” Computer, vol. 35, pp.27-30, April 2002.

    CrossRef  Google Scholar 

  11. G. Adam, “Anomaly Detection in Distributed Computer Communication Systems,” Cybernetics and Systems, vol. 37, pp.635-652, September 2006.

    CrossRef  Google Scholar 

  12. J. Zhang and M. Zulkernine, “Hybrid Network Intrusion Detection Technique Using Random Forests,” in The First International Conference on Availability, Reliability and Security (ARES 2006), April 2006, pp.262-269.

    Google Scholar 

  13. M. Suydam, “Application-Based Idss: Upping the Application Ante,” 1999, http://infosecuritymag.techtarget.com/articles/1999/ids.shtml.

    Google Scholar 

  14. J. Zhou and G. Vigna, “Detecting Attacks That Exploit Application-Logic Errors through Application-Level Auditing,” in Proceedings of the 20th Annual Computer Security Applications Conference (ACSAC’04), December 2004, pp.168-178.

    Google Scholar 

  15. E. Tombini, H. Debar, L. Me and M. Ducasse, “A Serial Combination of Anomaly and Misuse Idses Applied to Http Traffic,” in 20th Annual Computer Security Applications Conference, 2004., December 2004, pp.428-437.

    Google Scholar 

  16. P. Samarati, E. Bertino, A. Ciampichetti and S. Jajodia, “Information Flow Control in Object-Oriented Systems,” IEEE Transactions on Knowledge and Data Engineering, vol. 9, pp.624-538, July-August 1997.

    CrossRef  Google Scholar 

  17. S. Jajodia, B. Kogan and R. Sandhu, “A Multilevel-Secure Object-Oriented Data Model,” Tech. Rep., pp.596-616, 1992.

    Google Scholar 

  18. A. Sabelfeld and A.C. Myers, “Language-Based Information-Flow Security,” IEEE Journal on Selected Areas in Communications, vol. 21, pp.5-19, January 2003.

    CrossRef  Google Scholar 

  19. S. Jajodia and B. Kogan, “Integrating an Object-Oriented Data Model with Multilevel Security,” in 1990 IEEE Symposium on Security and Privacy, May 1990, pp.76-85.

    Google Scholar 

  20. S. Zdancewic, “Challenges in Information-Flow Security,” presented at The First International Workshop on Programming Language Interference and Dependence (PLID), Verona, Italy, 2004.

    Google Scholar 

  21. J. Viega, J.T. Bloch and P. Chandra, “Applying Aspect-Oriented Programming to Security,” Cutter IT Journal, vol. 14, pp.31-39, February 2001.

    Google Scholar 

  22. K. Padayachee and J.H.P. Eloff, “Information Flow Control within AOP,” October 2006, http://www.osprey.unisa.ac.za/TechnicalReports/ index. html.

    Google Scholar 

  23. W. Masri and A. Podgurski, “Using Dynamic Information Flow Analysis to Detect Attacks against Applications,” presented at Proceedings of the 2005 workshop on Software engineering for secure systems-building trustworthy applications, ACM Press New York, NY, USA, St. Louis, Missouri, 2005.

    Google Scholar 

  24. N. Kuntze, T. Rauch and A.U. Schmidt, “Security for Distributed Web Applications Via Aspect Oriented Security,” presented at Conference Information Security South Africa, Sandton, South Africa, 2005.

    Google Scholar 

  25. F. Ortin and J.M. Cueva, “Dynamic Adaptation of Application Aspects,” Journal of Systems and Software, vol. 71, pp.229-243, May 2004.

    Google Scholar 

  26. J. Viega and J. Voas, “Can Aspect-Oriented Programming Lead to More Reliable Software,” IEEE Software, vol. 17, pp.19-21, November 2000.

    CrossRef  Google Scholar 

  27. D. Mahrenholz, O. Spinczyk and W. Schröder-Preikschat, “Program Instrumentation for Debugging and Monitoring with Aspectc++,” in Proceedings of The 5th IEEE International Symposium on Object-oriented Real-time Distributed Computing, April - May 2002, pp.249-256.

    Google Scholar 

  28. B. De Win, W. Joosen and F. Piessens. "Developing Secure Applications through Aspect-Oriented Programming." in Aspect-Oriented Software Development, Aksit, M., Clarke, S., Elrad, T. and Filman, R.E. Eds., Boston: Addison-Wesley, 2002, pp.633–650.

    Google Scholar 

  29. G. Kiczales, E. Hilsdale, J. Hugunin, M. Kersten and J. Palm, “Getting Started with Aspectj,” Communications of the ACM, vol. 44, pp.59-65, October 2001.

    CrossRef  Google Scholar 

  30. P. Robinson, M. Rits and R. Kilian-Kehr, “An Aspect of Application Security Management,” presented at AOSD’04 International Conference on Aspect-Oriented Software Development, Lancaster, UK, 2004.

    Google Scholar 

  31. R. Bodkin, “Enterprise Security Aspects,” presented at AOSD’04 International Conference on Aspect-Oriented Software Development, Lancaster, UK, 2004.

    Google Scholar 

  32. V. Shah and F. Hill, “An Aspect-Oriented Security Framework,” in DARPA Information Survivability Conference and Exposition, April 2003, pp.143.

    Google Scholar 

  33. P. Slowikowski and K. Zielinski, “Comparison Study of Aspect-Oriented and Container Managed Security,” presented at AAOS 2003:Analysis of Aspect-Oriented Software (Workshop held in conjunction with ECOOP 2003), AGH University of Science and Technology, Darmstadt, Germany, 2003.

    Google Scholar 

  34. H. Masuhara and K. Kawauchi, “Dataflow Pointcut in Aspect-Oriented Programming,” in Proceedings of The First Asian Symposium on Programming Languages and Systems (APLAS’03), November 2003, pp.105-121.

    Google Scholar 

  35. K. Padayachee, J.H.P. Eloff and J. Bishop, “Aspect-Oriented Information Flow Control,” unpublished.

    Google Scholar 

  36. H. Chivers and J. Jacob, “Specifying Information-Flow Controls,” in Proceedings of the 25th IEEE International Conference on Distributed Computing System Workshops (ICDCSW ’05), June 2005, pp.114-120.

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. School of Computing, University of South Africa, Pretoria 0003, South Africa

    K. Padayachee

  2. Department of Computer Science, University of Pretoria, Pretoria 0002, South Africa

    J.H.P. Eloff

Authors
  1. K. Padayachee
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. J.H.P. Eloff
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. University of Bridgeport, CT, USA

    Tarek Sobh

Rights and permissions

Reprints and Permissions

Copyright information

© 2007 Springer

About this paper

Cite this paper

Padayachee, K., Eloff, J. (2007). An Aspect-Oriented Model to Monitor Misuse. In: Sobh, T. (eds) Innovations and Advanced Techniques in Computer and Information Sciences and Engineering. Springer, Dordrecht. https://doi.org/10.1007/978-1-4020-6268-1_49

Download citation

  • DOI: https://doi.org/10.1007/978-1-4020-6268-1_49

  • Publisher Name: Springer, Dordrecht

  • Print ISBN: 978-1-4020-6267-4

  • Online ISBN: 978-1-4020-6268-1

  • eBook Packages: EngineeringEngineering (R0)

Publish with us

Policies and ethics

search

Navigation