GHIDS: Defending Computational Grids against Misusing of Shared Resources

Detecting intrusions at host level is vital to protecting shared resources in grid, but traditional Host-based Intrusion Detecting System (HIDS) is not suitable for grid environment. Grid-specific attacks are different from traditional ones, and traditional HIDS can not recognize a grid user and always with high performance overhead. This paper proposes a Grid- specific Host-based Intrusion Detection System (GHIDS) which employs bottleneck verification approach to detect intrusions with low false alarm rate and high detection rate. Working within operating system kernel and performing bottleneck verification by integer comparison, GHIDS achieves high efficiency and accuracy. Security reports generated by GHIDS are indexed not only by local user ID, but also by Grid user ID. That is more useful for analyzing grid user behaviors globally by both host administrators and high level Grid-based IDS.