Systems and Means of Informatics
2016, Volume 26, Issue 3, pp 60-73
PROTECTION OF BUSINESS LOGIC AGAINST ZERO DAY ATTACKS
- A. A. Grusho
- D. V. Smirnov
Abstract
The paper is devoted to creation of architecture of an information system steady against zero day attacks from the Internet. Justification of security of an information system from zero day attacks is found and the description of conditions under which the required security is provided is given. The architecture of information systems of commercial producers regarding resistance to zero day attacks is analyzed, the model of threats to information systems available in the Internet is described, and the methods of realization of protection of information systems against zero day attacks are developed.
[+] References (8)
- ISO/IEC/IEEE 42010:2011. Systems and software engineering - architecture description. Available at: http://cabibbo.dia.uniroma3.it/asw/altrui/iso-iec-ieee-42010- 2011 .pdf (accessed August 25, 2016).
- Application Server Security Guide 10g. Available at: https://docs.oracle.com/cd/ B14099_19/core.l012/bl3999/rectop.htm (accessed August 25, 2016).
- Bhushan, B., and C. Khoury. 2013. DataPower Common Use Cases. Available at: https://www.ibm.com/developerworks/community/files/basic/anonymous/api/library /cfa136f0-30c1-4177-9901-62c05d900c5f/document/b6a0dd24-f7ac-4f29-8fff-0b9413 cfb4da/media/lmpact2013_TSI-3089%20-%20DataPower%20Common%20Use%20 Cases.pdf (accessed August 25, 2016).
- Rivlin, A., T. Csapo, D. Dimitrova, and D. Mihaylov. 2015. SAP Enterprise Portal and SAP Fiori: Common architecture and recommendations. Available at: http:// a248.g.akamai.net/n/248/420835/e31e96ee7bd4894bbfb39d92d930463141dfb15172d c955b62d1bde2affde8e1/sapasset.download.akamai.com/420835/sapcom/docs/2015/ 07/dadd2aec-597c-0010-82c7-eda71af511fa.pdf (accessed August 25, 2016).
- Schneier, B. 2011. Schneier-Ranum face-off on whitelisting and blacklisting. Available at: https: //www. schneier.com/essays/arch ives/2011/01/schneier-ranum jface- .html (accessed August 25, 2016).
- Grusho, A., N. Grusho, E. Timonina, and S. Shorgin. 2014. Bezopasnye arkhitek- tury raspredelennykh sistem [Secure architecture of the distributed systems]. Sistemy i Sredstva Informatiki - Systems and Means of Informatics 24 (3): 18-31.
- Varnovsky, N. P., and A. V. Shokurov. 2007. Gomomorfnoe shifrovanie [Homomorphic enciphering]. Trudy Instituta Sistemnogo Programmirovaniya RAN [Proceedings of the Institute for System Programming of the Russian Academy of Sciences] 12:27-36.
- Pushnikov, A. Yu. 1999. Vvedenie v sistemy upravleniya bazami dannykh. Chast' 1. Relyatsionnaya model' dannykh. Glava 9. Tranzaktsii i tselostnost' baz dannykh [Introduction to database management systems. Part 1. Relational model of data. Ch. 9. Transactions and integrity of databases]. Ufa: Bashkir University. 108 p.
[+] About this article
Title
PROTECTION OF BUSINESS LOGIC AGAINST ZERO DAY ATTACKS
Journal
Systems and Means of Informatics
Volume 26, Issue 3, pp 60-73
Cover Date
2016-08-30
DOI
10.14357/08696527160304
Print ISSN
0869-6527
Publisher
Institute of Informatics Problems, Russian Academy of Sciences
Additional Links
Key words
information security; zero day attacks; business logic; white lists; black lists; secure architecture; security server
Authors
A. A. Grusho  and D. V. Smirnov 
Author Affiliations
Institute of Informatics Problems, Federal Research Center "Computer Science
and Control", Russian Academy of Sciences, 44-2 Vavilov Str., Moscow 119333, Russian Federation
Sberbank of Russia, 19 Vavilov Str., Moscow 117999, Russian Federation
|