Stochastic Modeling of Intrusion-Tolerant Server Architectures for Dependability and Performance Evaluation∗

In this work, we present a first effort at quantitatively comparing the strengths and limitations of variousintrusion-tolerant server architectures. We study four representative architectures, and use stochastic mod-els to quantify the costs and benefits of each from both the performance and dependability perspectives. Wedescribe in detail how the models were constructed using Stochastic Activity Networks (SANs), a variantof stochastic Petri nets. We present results characterizing throughput and availability, the effectiveness ofarchitectural defense mechanisms, and the impact of the performance versus dependability tradeoff. Webelieve that the results of this evaluation will help system architects to make informed choices for buildingmore secure and survivable server systems.