The emergence of intelligent and sophisticated attack techniques makes web services more vulnerable than ever which are becoming an important business tool in e-commerce. Many techniques have been proposed to remove the security vulnerabilities, yet have limitations. This paper proposes an adaptive mechanism for a web-server intrusion-tolerant system (WITS) to prevent unknown patterns of attacks by adapting known attack patterns. SYN flooding attacks and their adaptive defense mechanisms are simulated as a case study to evaluate the performance of the proposed adaptation mechanism.

The traditional approach for establishing the correctness of group communication protocols is through rigorous arguments. While this is a valid approach, the likelihood of subtle errors in the design and implementation of such complex distributed protocols is not negligible. The use of formal verification methods has been widely advocated to instill confidence in the correctness of protocols. In this paper, we describe how we used the SPIN model checker to formally verify a group membership protocol that is part of an intrusion-tolerant group communication system. We describe how we successfully tackled the state-space explosion problem by determining the right abstraction level for formally specifying the protocol. The verification exercise not only formally showed that the protocol satisfies its correctness claims, but also provided information that will help us make the protocol more efficient without violating correctness.