We formulate intrusion tolerance for a system with service replicas as a
two-level optimal control problem. On the local level node controllers perform
intrusion recovery, and on the global level a system controller manages the
replication factor. The local and global control problems can be formulated as
classical problems in operations research, namely, the machine replacement
problem and the inventory replenishment problem. Based on this formulation, we
design TOLERANCE, a novel control architecture for intrusion-tolerant systems.
We prove that the optimal control strategies on both levels have threshold
structure and design efficient algorithms for computing them. We implement and
evaluate TOLERANCE in an emulation environment where we run 10 types of network
intrusions. The results show that TOLERANCE can improve service availability
and reduce operational cost compared with state-of-the-art intrusion-tolerant
systems.

我们设计了一个新颖的控制架构 TOLERANCE 来应对具有服务副本的系统中的入侵容忍问题。我们证明了在两个控制层级上的最优控制策略具有阈值结构，并设计了有效的算法来计算它们。通过在仿真环境中运行 10 种网络入侵，我们验证了 TOLERANCE 可以提高服务可用性并降低运营成本。