A model for detecting "global footprint anomalies" in a grid environment

Abstract

Grid computing environments pose unique security concerns that are not generally relevant for conventional data management systems. An event that appears as benign on a grid node, may actually be part of a larger incident hazardous to the grid. Since a node only sees the local footprint of an event, it cannot know the contribution of this event at a global scale. The focus of this work is on detecting such kinds of anomalous behaviors that we call global anomalies. In this paper, we propose two classes of global anomalies, and a model for detection of a class of global anomalies that we call global footprint anomalies. The main challenge here is to detect anomalous behavior, which looks normal locally at any individual grid node, but when observed globally, the anomalous behavior is apparent. © 2010 Springer-Verlag.