English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Big data platforms such as Hadoop and Spark are being widely adopted both byacademia and industry. In this paper, we propose a runtime intrusion detectiontechnique that understands and works according to the properties of suchdistributed compute platforms. The proposed method is based on runtime analysisof system and library calls and memory access patterns of tasks running on thedatanodes (slaves). First, the primary datanode of a big data system creates abehavior profile for every task it executes. A behavior profile includes (a)trace of the system & library calls made, and (b) sequence representing thesizes of private and shared memory accesses made during task execution. Then,the process behavior profile is shared with other replica datanodes that arescheduled to execute the same task on their copy of the same data. Next, thesereplica datanodes verify their local tasks with the help of the informationembedded in the received behavior profiles. This is realized in two steps: (i)comparing the system & library calls metadata, and (ii) statistical matching ofthe memory access patterns. Finally, datanodes share their observations forconsensus and report an intrusion to the namenode (master) if they find anydiscrepancy. The proposed solution was tested on a small hadoop cluster usingthe default MapReduce examples and the results show that our approach candetect insider attacks that cannot be detected with the traditional analysismetrics.

Call Trace and Memory Access Pattern based Runtime Insider Threat Detection for Big Data Platforms