Since current computer infrastructures are increasingly vulnerable to malicious activities, intrusion detection is necessary but unfortunately not sufficient. We need to design effective response techniques to circumvent intrusions when they are detected. Our approach is based on a library that implements different types of counter-measures. The idea is to design a decision support tool to help the administrator to choose, in this library, the appropriate counter-measure when a given intrusion occurs. For this purpose, we formally define the notion of anti-correlation which is used to determine the counter-measures that are effective to stop the intrusion. Finally, we present a pla!form of intrusion detection that implements the response mechanisms presented in this paper. R~sum~Etant donn6 que les systbmes informatiques sont de plus en plus vuln6rables aux activit(s malveillantes, l' utilisation de la d6tection d'intrusion est n(cessaire mais ne suffit pas. Nous devons (laborer des m6thodes efficaces de r(action aux intrusions afin d'arr~ter les intrusions d(tect~es. Notre approche est bas6e sur une biblioth~que de diff(rents types de contremesures. L'objectif est d'aider l'administrateur & choisir dans cette bibliothkque la contre-mesure la mieux adapt~e quand une intrusion est d(tect~e. Pour ce faire nous d~finis-sons formellement la notion d'anti-corr6lation qui est utilis6e pour s6lectionner les contremesures permettant d'arr6ter l'intrusion. Nous finissons par la presentation d'une plateforme de d(tection d'intrusion mettant en ~euvre les m(canismes pr(sent6s dans cet article. Mots cl6s : S6curit~ informatique, D6tecteur intrus, Protection information. Corr61ation, Mod~lisation, ModUle logique.
Abstract. In this paper we present an access control model that considers both abstract and concrete access control policies specifications. Permissions and prohibitions are expressed within this model with contextual conditions. This situation may lead to conflicts. We propose a type system that is applied to the different rules in order to check for inconsistencies. If a resource is well typed, it is guaranteed that access rules to the resource contain no conflicts.
To cite this version:Yacine Bouzida, Frédéric Cuppens, Sylvain Gombault. Detecting and reacting against distributed denial of service attacks.Abstract-Distributed denial of service attacks (DDoS) are becoming a big threat to the Internet. Recently, some DDoS attacks have infected more than 100, 000 vulnerable hosts over Internet within 10 minutes. Consequences of these attacks can be devastating toward many companies whose security policy against this kind of attacks relies only on reconfiguring firewalls. It is judicious to note that no computer network is immune from intrusions in general and distributed denial of service attacks in particular. Intrusion detection systems should be geographically distributed to detect distributed and cooperated attacks. In this paper, we use a cooperative approach, which uses the Intrusion Detection Message Exchange Format (IDMEF) defined by the IETF, that can detect coordinated attack scenarios through alert correlation of distributed IDSs. We present our experience in realizing this cooperative system and the different results obtained from its implementation in a real network.
Abstract.It is well known that signature based intmsion detection systems are only able to detect known attacks. Unfortunately, current anomaly based intrusion detection systems are also unable to detect all kinds of new attacks because they are designed to restricted applications on limited environment. Current hackers are using new attacks where neither access control systems nor current signature based systems can prevent the devastating results of these attacks against information systems. We enhance the notion of anomaly detection, introduce necessary conditions that should be taken into account by the building detection models and propose a new machine learning algorithm based on decision trees to discover known and unknown attacks in real time. Experimental results demonstrate that the proposed method is highly successful in detecting new attacks and significantly outperforms previous work.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.
hi@scite.ai
10624 S. Eastern Ave., Ste. A-614
Henderson, NV 89052, USA
Copyright © 2024 scite LLC. All rights reserved.
Made with 💙 for researchers
Part of the Research Solutions Family.