Network management and intrusion detection for quality of network services

The explosive growth in worldwide communication via the Internet has increased the reliance of organizations and individuals on the electronically transmitted information, which consequently created rising demands to protect data from information leakage, corruption or alteration during transmission. Various security service requirements are demanded among different applications and customers with consideration of respective data sensitivity level, performance requirement and monetary investment. It becomes important to provide end-to-end security service commitment to satisfy the diverse customers needs. We expect the Quality of Protection (QoP) to fulfill end-to-end security service commitment to be integrated within the emerging QoS networks to support secure QoS Internet service. For clarity, we call both of QoP and QoS “Quality of Network Services” (QoNS).; The security issues surrounding the QoNS (QoP and QoS) provisioning have been studied in my PhD research. The thesis is composed of two main parts, i.e. QoP security and QoS security. First, the policy issues of QoP security service are analyzed and automatic policy generation algorithms are presented. Furthermore, a signaling protocol is designed to provide end-to-end security service for QoP. The protocol is designed to be secure to protect messages against possible forgery and modification attacks. Second, the threats to the QoS signaling protocol RSVP are analyzed and countermeasures are proposed. In addition, the intrusion detection methods for QoS attacks directly on data flow are investigated and experimented.