A Bio-Inspired Reaction Against Cyberattacks: AIS-Powered Optimal Countermeasures Selection

Nespoli, Pantaleone; Mármol, Félix Gómez; Vidal, Jorge Maestre

doi:10.1109/access.2021.3074021

“…In this sense, several attack models have been proposed in the literature so far, and some of them already integrate the Attack Trees representation adding countermeasures (e.g., Attack Countermeasures Trees [48], Attack Response Trees [49], etc.). Thus, ChaosXploit may incorporate those representations in the Knowledge base and select the optimal reaction to fire against the threat based on specific criteria [50]. Moreover, the performance of ChaosXploit should be further evaluated to prove its usefulness in performance-demanding or critical scenarios.…”

Section: Discussionmentioning

confidence: 99%

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

Chavarro

¹

,

Nespoli

²

,

Díaz-López

³

et al. 2022

BDCC

Self Cite

View full text Add to dashboard Cite

Software is behind the technological solutions that deliver many services to our society, which means that software security should not be considered a desirable feature anymore but more of a necessity. Protection of software is an endless labor that includes the improvement of security controls but also the understanding of the sources that induce incidents, which in many cases are due to bad implementation or assumptions of controls. As traditional methods may not be efficient in detecting those security assumptions, novel alternatives must be attempted. In this sense, Security Chaos Engineering (SCE) becomes an innovative methodology based on the definition of a steady state, a hypothesis, experiments, and metrics, which allow to identify failing components and ultimately protect assets under cyber risk scenarios. As an extension of a previous work, this paper presents ChaosXploit, an SCE-powered framework that employs a knowledge database, composed of attack trees, to expose vulnerabilities that exist in a software solution that has been previously defined as a target. The use of ChaosXploit may be part of a defensive security strategy to detect and correct software misconfigurations at an early stage. Finally, different experiments are described and executed to validate the feasibility of ChaosXploit in terms of auditing the security of cloud-managed services, i.e., Amazon buckets, which may be prone to misconfigurations and, consequently, targeted by potential cyberattacks.

show abstract

“…Many researchers apply approximate bio-inspired solutions like GAs to approach this problem. In [16], the authors proposed an AIS to select countermeasures to defeat cyberattacks through cloning and mutation phases. They, however, suggested a context-aware stop condition based on experimental outcomes and authors' subjective beliefs.…”

Section: Methodological Approachesmentioning

confidence: 99%

Intrusion Response Systems for the 5G Networks and Beyond: A New Joint Security-vs-QoS Optimization Approach

Bozorgchenani,

Zarakovitis,

Chien

et al. 2024

IEEE Trans. Netw. Sci. Eng.

0

View full text Add to dashboard Cite

Network connectivity exposes the network infrastructure and assets to vulnerabilities that attackers can exploit. Protecting network assets against attacks requires the application of security countermeasures. Nevertheless, employing countermeasures incurs costs, such as monetary costs, along with time and energy to prepare and deploy the countermeasures. Thus, an Intrusion Response System (IRS) shall consider security and QoS costs when dynamically selecting the countermeasures to address the detected attacks. This has motivated us to formulate a joint Security-vs-QoS optimization problem to select the best countermeasures in an IRS. The problem is then transformed into a matching game-theoretical model. Considering the monetary costs and attack coverage constraints, we first derive the theoretical upper bound for the problem and later propose stable matching-based solutions to address the trade-off. The performance of the proposed solution, considering different settings, is validated over a series of simulations.

show abstract

“…Many researchers apply approximate bio-inspired solutions like Genetic Algorithms (GAs) to approach this problem. In [10], the authors proposed an Artificial Immune System (AIS) to select countermeasures to defeat cyberattacks through cloning and mutation phases. They, however, suggested a context-aware stop condition based on experimental outcomes and authors' subjective beliefs.…”

Section: Related Workmentioning

confidence: 99%

Joint Security-vs-QoS Game Theoretical Optimization for Intrusion Response Mechanisms for Future Network Systems

Bozorgchenani¹,

Zarakovitis²,

Chien³

et al. 2023

Preprint

0

View full text Add to dashboard Cite

Network connectivity exposes the network infrastructure and assets to vulnerabilities that attackers can exploit. Protecting network assets against attacks requires the application of security countermeasures. Nevertheless, employing countermeasures incurs costs, such as monetary costs, along with time and energy to prepare and deploy the countermeasures. Thus, an Intrusion Response System (IRS) shall consider security and QoS costs when dynamically selecting the countermeasures to address the detected attacks. This has motivated us to formulate a joint Security-vs-QoS optimization problem to select the best countermeasures in an IRS. The problem is then transformed into a matching game-theoretical model. Considering the monetary costs and attack coverage constraints, we first derive the theoretical upper bound for the problem and later propose stable matching-based solutions to address the trade-off. The performance of the proposed solution, considering different settings, is validated over a series of simulations.

show abstract

A Bio-Inspired Reaction Against Cyberattacks: AIS-Powered Optimal Countermeasures Selection

Cited by 16 publications

References 48 publications

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

On the Way to Automatic Exploitation of Vulnerabilities and Validation of Systems Security through Security Chaos Engineering

Intrusion Response Systems for the 5G Networks and Beyond: A New Joint Security-vs-QoS Optimization Approach

Joint Security-vs-QoS Game Theoretical Optimization for Intrusion Response Mechanisms for Future Network Systems

Contact Info

Product

Resources

About