Title: Intrusion Prevention and Detection in Grid Computing - The ALICE Case,
Abstract: Grids allow users flexible on-demand usage of computing resources through
remote communication networks. A remarkable example of a Grid in High Energy
Physics (HEP) research is used in the ALICE experiment at European Organization
for Nuclear Research CERN. Physicists can submit jobs used to process the huge
amount of particle collision data produced by the Large Hadron Collider (LHC).
Grids face complex security challenges. They are interesting targets for
attackers seeking for huge computational resources. Since users can execute
arbitrary code in the worker nodes on the Grid sites, special care should be
put in this environment. Automatic tools to harden and monitor this scenario
are required. Currently, there is no integrated solution for such requirement.
This paper describes a new security framework to allow execution of job
payloads in a sandboxed context. It also allows process behavior monitoring to
detect intrusions, even when new attack methods or zero day vulnerabilities are
exploited, by a Machine Learning approach. We plan to implement the proposed
framework as a software prototype that will be tested as a component of the
ALICE Grid middleware.