22-04-2010, 12:29 AM
Automatic Integrity Checks for Remote Web Resources
Existing tools for automatically detecting Web site defacement compare monitored Web resources with uncorrupted copies of the content kept in a safe place. This can be an expensive and difficult task, especially when working with dynamic resources. In contrast,the proposed tool uses sensors and alarms to automatically monitor remote Web resources' integrity. Such a framework could help designers build services to inexpensively monitor multiple Web sites, which could be very attractive for small, budget-limited organizations thatdepend on the Web for their operation.
The Activities of the tool are
1. retrieve the resource;
2. analyzes the content of the resource to detect signs of unauthorized modifications;
3. if the analysis suggests that an unauthorized change could have been applied to the resource,
execute some predefined task. In practice this could involve sending an alert at a specified
paging device. This issue is orthogonal to the topic of this paper, so we shall not mention it
any further.
The core is step 2. First, a set of sensors is applied on the resource. A sensor is an algorithm that analyzes a specific feature of the resource and returns a boolean. A true return value is taken as an indication that the resource content is somewhat €œunusual€ or €œsuspect€Â. Then, the output of the sensors are input to an alarm, an algorithm that combines the results of sensors and returns a boolean. If the alarm returns true, this is taken as an indication that the integrity of the resource might have been compromised.
Obviously, a one-size-fits-all approach cannot work in this context. For this reason, each resource may have its own set of sensors and alarms. Moreover, each sensor has a set of parameters whose values can be tailored to the resource to which the sensor is applied. Finally, the tool has a €œselftuning€ ability: when given a new resource to monitor, the tool may observe the resource for a specified period and choose suitable parameters for the sensors automatically.
Existing tools for automatically detecting Web site defacement compare monitored Web resources with uncorrupted copies of the content kept in a safe place. This can be an expensive and difficult task, especially when working with dynamic resources. In contrast,the proposed tool uses sensors and alarms to automatically monitor remote Web resources' integrity. Such a framework could help designers build services to inexpensively monitor multiple Web sites, which could be very attractive for small, budget-limited organizations thatdepend on the Web for their operation.
The Activities of the tool are
1. retrieve the resource;
2. analyzes the content of the resource to detect signs of unauthorized modifications;
3. if the analysis suggests that an unauthorized change could have been applied to the resource,
execute some predefined task. In practice this could involve sending an alert at a specified
paging device. This issue is orthogonal to the topic of this paper, so we shall not mention it
any further.
The core is step 2. First, a set of sensors is applied on the resource. A sensor is an algorithm that analyzes a specific feature of the resource and returns a boolean. A true return value is taken as an indication that the resource content is somewhat €œunusual€ or €œsuspect€Â. Then, the output of the sensors are input to an alarm, an algorithm that combines the results of sensors and returns a boolean. If the alarm returns true, this is taken as an indication that the integrity of the resource might have been compromised.
Obviously, a one-size-fits-all approach cannot work in this context. For this reason, each resource may have its own set of sensors and alarms. Moreover, each sensor has a set of parameters whose values can be tailored to the resource to which the sensor is applied. Finally, the tool has a €œselftuning€ ability: when given a new resource to monitor, the tool may observe the resource for a specified period and choose suitable parameters for the sensors automatically.