Intrusion detection systems (IDS) look for digital patterns mainly over the network or host traffic. Increasing complexity of todays enterprise information systems (EIS) obliges enterprises to deploy multiple but yet isolated IDSs in their IT boundaries, namely in, network (NIDS), host (HIDS), DMZs and application (appIDS). Modern exploits being able to disguise may appear innocent from an individual IDS perspective, however, its maliciousness could be detected from an end to end application perspective. One of the core problems in this regard is the inability of detecting such end to end targeted attacks whose functional scopes may stretch across IT boundaries. In this paper, we first argue that complex end to end intrusions can be detected in real time by analyzing application level logs originating from various IT boundaries (network, proxy, web server, OS, application etc.). We propose an attack pattern framework for EIS that enables an appIDS, such as SAP Enterprise Threat Detection (ETD) [1], to perform log analysis simultaneously from multiple sources. The framework includes a reference architecture and its prototypical implementation can be the core engine of an appIDS. It also provides an attack pattern specification language and associated methodology for managing attack pattern lifecycle and appropriate alert mitigation response.

Computational trust is a central paradigm in today’s Internet as our modern society is increasingly relying upon online transactions and social networks. This is indeed leading to the introduction of various trust management systems and associated trust models, which are customized according to their target applications. However, the heterogeneity of trust models prevents exploiting the trust knowledge acquired in one context in another context although this would be beneficial for the digital, ever-connected environment. This is such an issue that this paper addresses by introducing an approach to achieve interoperability between heterogeneous trust management systems. Specifically, we define a trust meta-model that allows the rigorous specification of trust models as well as their composition. The resulting composite trust models enable heterogeneous trust management systems to interoperate transparently through mediators.

Integration of heterogeneous distributed systems becomes particularly challenging when these systems have diverse coordination models (e.g., client/server, publish/subscribe, tuple space). In this paper, we introduce a system integration solution based on orchestration workflow and a high-level data-driven coordination abstraction enabling application workflows that are agnostic to the underlying middleware platforms and associated coordination models of the constituent systems. Our solution features an extensible generic coordination middleware, which enables middleware designers to easily incorporate support for new middleware platforms and facilitates application designers in designing complex applications.

The OASIS eXtensible Access Control Language (XACML) provides an interoperable tool for writing and enforcing access control policies based on attributes, i.e. characteristics of the entities that take part to the access, such as subjects or actions. Unfortunately, the attribute based approach starts to show its limits when entities exhibit complex relationships, such as semantic relations, which would be easily captured using ontologies instead of attributes. This paper integrates the XACML attribute model with an OWL ontology and describes a practical privacy filtering application able to filter out information from XML documents, according to a set of XACML semantic privacy policies.

Collaborating on complex XML data structures is a non-trivial task in domains such as the public sector, healthcare or engineering. Specifically, providing a distributed XML content dissemination services in a selective and secure fashion is a challenging task. This paper proposes a publish/subscribe infrastructure to disseminate enterprise XML content utilizing document semantics. Our approach relies on the dissemination of XML documents based on their content, as described by ontology concepts that form the basis for an interoperable description of XML documents. This infrastructure leverages our earlier encryption enabled document parsing [20] scheme for protecting the integrity and confidentiality of XML content during dissemination.

Collaborating on complex XML data structures is a non-trivial task in domains such as the public sector,healthcare or engineering. Specifically, providing scalable XML content dissemination services in a selective and secure fashion is a challenging task. This paper describes a publish/subscribe middleware infrastructure to achieve a content-based dissemination of XML documents. Our approach relies on the dissemination of XML documents based on their semantics, as described by concepts that form an interoperable description of documents. This infrastructure leverages our earlier scheme [1] for protecting the integrity and confidentiality of XML content during dissemination.

A typical workflow is specified by a set of predefined tasks executed in a sequence flow in which business objects represented as documents are handled to reach a business goal. Workflow actors with precise roles handle documents reflecting the results of executed tasks. However, increasing agile nature of business processes implies neither the potential tasks nor their sequence flow can be defined a priori. In this context, a document-based workflow (DocWF) in which the handled documents may preserve the statefulness of a business process helping an actor to define potential tasks and their sequence flow at runtime. In this paper, we present a formal model of a DocWF to address agile business processes. We first classify the associated entities and their relationships in a meta-model. To this end, a formal execution model of a DocWF system is provided. We illustrate a dynamic execution with an electronic health record (EHR) generation workflow that handles an XML document of EHR.

Task-based workflows describe a set of predefinedtasks executed in a predefined sequence flow in whichdocuments representing business objects are sent to activate tasks according to some business goal. The increasingly agile nature of business processes implies that neither the potential tasks nor their sequence flow can be defined a priori. In this context, documents may constitute the central abstraction in a business process execution while services are stateless entities. While business goals and associated business rules drive models and their executions, document content and its structure may additionally be used to determine how the document can be processed and how multiple processing tasks may be composed dynamically.This paper introduces a document-based workflow modelthat implements such agile business processes. The described approach relies on the use of a rule-based system as ameans to capture diverse concerns such as business goals and associated rules within a uniform framework. To this end, we illustrate this approach with an electronic health record (EHR) application.

This paper presents an ontology-driven secure XML content distribution scheme. This scheme first relies on a semantic access control model for XML documents that achieves three objectives: (1) representing flexible and evolvable policies, (2) providing a high-level mapping and interoperable interface to documents, and (3) automating the granting of fine-grained access rights by inferring on content semantics. A novel XML document parsing mechanism is defined to delegate document access control enforcement to a third party without leaking the document XML schema to it. The Encrypted Breadth First Order Labels (EBOL) encoding is used to bind semantic concepts with XML document nodes and to check the integrity of a document.

Comparing different versions of large tree structured data is a CPU and memory intensive task. State of the art techniques require the complete XML trees and their internal representations to be loaded into memory before any comparison may start. Furthermore, comparing sanitized XML trees is not addressed by these techniques. We propose a comparison technique for sanitized XML documents which ultimately results into a minimum cost edit script transforming the initial tree into the target tree. This method uses encrypted integer labels to encode the original XML structure and content, making the encrypted XML readable only by a legitimate party. Encoded tree nodes can be compared by a third party with a limited intermediate representation.

This paper introduces a distributed and fine grained access control mechanism based on encryption for XML document centric collaborative applications. This mechanism also makes it possible to simultaneously protect the confidentiality of a document and to verify its authenticity and integrity, as well to trace its updates. The enforcement of access control is distributed to participants and does not rely on a central authority. Novel aspects of the proposed framework include the adoption of a decentralized key management scheme to support the client-based enforcement of the access control policy. This scheme is driven by the expression of access patterns of interest of the participants over document parts to determine the keys required. A lazy rekeying protocol is also defined to accommodate the delegation of access control decisions that in particular reduces rekeying latency when faced with the addition and removal of participants.