Programming Models for Behavioral Monitoring of Distributed Networks

We provide a specification methodology to monitor the system-level compliance to properties deemed as critical for functioning of a distributed information system (DIS). Since information attacks due to external intrusion and/or component failures manifest as deviations from critical behaviors expected of a DIS, violation of a specified critical property can be viewed as symptomatic of information attacks. Users can prescribe critical properties in the form of event predicates, which are boolean conditions on the externally visible interface state distributed among computation nodes and can be detected by distributed algorithms. Any target application can then plugged-in to our generic monitor tool to test for its compliance to critical functionality. With distributed object-oriented programming support (e.g., JAVA), our monitor can reduce the software development costs of a DIS: due to the ease of specification and maintenance.