Detecting Credential Abuse in the Grid Using Bayesian Networks

Proxy Credentials serve as a principal for authentication and authorization in the Grid. Despite their limited lifetime, they can be intercepted and abused by an attacker. We counter this threat by enabling Grid users to track their credentials' use in Grid infrastructures, reporting all authentication and delegation operations to an auditing service. Our approach combines modifications to the security infrastructure with a Bayesian classifier in order to provide a reliable method for detecting abusive Grid credential usage and alerting the legitimate user. To validate this approach we created an extensive Grid simulation, simulating different types of legitimate and illegitimate use of credentials. Our experiments show that we can detect 99.5% of all abuse and our solution can thus help to increase security in the Grid.