Storage-Based Intrusion Detection for Storage Area Networks (SANs)

Storage systems are the next frontier for providing protection against intrusion. Since storage systems see changes to persistent data, several types of intrusions can be detected by storage systems. Intrusion detection (ID) techniques can be deployed in various storage systems. In this paper, we study how intrusions can be detected at the block storage level and in SAN environments. We propose novel approaches for storagebased intrusion detection and discuss how features of state-of-the-art block storage systems can be used for intrusion detection and recovery of compromised data. In particular we present two prototype systems. First we present a real time intrusion detection system (IDS) which has been integrated within a storage management and virtualization system. In this system incoming requests for storage blocks are examined for signs of intrusions in real time. We then discuss how intrusion detection schemes can be deployed as an appliance loosely coupled with a SAN storage s...

• Type: Conference
• Year: 2005
• Where: MSS
• Authors: Mohammad Banikazemi, Dan E. Poff, Bülent Abali
• Keywords: Block Storage, Intrusion Detection, MSS 2005, Storage System