The Starfish system: providing intrusion detection and intrusion tolerance for middleware systems

We introduce the Starfish system, a new system that provides intrusion detection and intrusion tolerance for middleware applications operating in an asynchronous distributed system. The Starfish system contains a central, highly secure and tightly coupled core. This core is augmented by "arms" that are less tightly coupled and that have less stringent security guarantees, each of which can be removed from the core if a significant security breach occurs. New arms can be "grown" as needed. The Starfish system employs a number of techniques for providing intrusion detection and intrusion tolerance. The specific challenges that we address are infrastructural support for voting and end-to-end intrusion detection.