CoRuM: Collaborative Runtime Monitor Framework for Application Security

We propose a framework based on Collaborative Runtime Monitors (CoRuM) for application-level security. CoRuM detects the abnormal behavior of an application by observing critical characteristics during program runtime. In this paper, we discuss the application's critical and essential characteristics to be monitored, the components of the framework, and its workflow on different use case scenarios. We provide experimental results on typical cyber-attacks and provide the throughput and detection accuracy measures. We also propose multidimensional preventive measures using honeypot and backup servers.