A framework for cost-sensitive automated selection of intrusion response

Strasburg, Christopher Roy

doi:10.31274/etd-180810-185

Cited by 4 publications

(12 citation statements)

References 23 publications

(36 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The aggregation and fusion of alarms should be taken into account by the detection system. This is assumption is in accordance to previous work [17], [24], [25].…”

Section: B Assumptionssupporting

confidence: 81%

“…A detection system might raise false alerts but to ensure a hundred percent certainty of the alerts or a sanity check of the detection engine is out of scope of this work. This strong confidence is in accordance to [17], [24], [25].…”

Section: Confidencesupporting

confidence: 56%

“…This approach is also described in several other publications of the authors [16], [17], [28] and will be referred as CS-IRS in the following.…”

Section: A Framework For Cost Sensitive Assessment Of Intrusion Rementioning

confidence: 99%

“…Therefore inline IDSs are also called intrusion prevention systems. However, IPSs do not employ a distinct response selection process and thus rely on simple mappings of attacks to predefined responses [17]. To overcome these shortcomings that just simple response actions or even no action can be taken, IRSs have been developed.…”

Section: Scenariomentioning

confidence: 99%

“…The systems security policy contains a value between 0 and 1 that represents the importance for the overall system with respect to the security goals confidentiality, integrity, availability. CS-IRS also requires the enumeration of system resources with their importance to the system and definitions of known intrusions [17]. CS-IRS was designed to work as a host-based solution and thus provides response measures to reboot the system, block user accounts or restart a service.…”

Section: A Framework For Cost Sensitive Assessment Of Intrusion Rementioning

confidence: 99%

See 4 more Smart Citations

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

Ossenbuhl¹,

Steinberger

Baier³

2015

2015 Ninth International Conference on IT Security Incident Management &Amp; IT Forensics

View full text Add to dashboard Cite

The increasing amount of network-based attacks evolved to one of the top concerns responsible for network infrastructure and service outages. In order to counteract these threats, computer networks are monitored to detect malicious traffic and initiate suitable reactions. However, initiating a suitable reaction is a process of selecting an appropriate response related to the identified network-based attack. The process of selecting a response requires to take into account the economics of an reaction e.g., risks and benefits. The literature describes several response selection models, but they are not widely adopted. In addition, these models and their evaluation are often not reproducible due to closed testing data. In this paper, we introduce a new response selection model, called REASSESS, that allows to mitigate network-based attacks by incorporating an intuitive response selection process that evaluates negative and positive impacts associated with each countermeasure. We compare REASSESS with the response selection models of IE-IRS, ADEPTS, CS-IRS, and TVA and show that REASSESS is able to select the most appropriate response to an attack in consideration of the positive and negative impacts and thus reduces the effects caused by an network-based attack. Further, we show that REASSESS is aligned to the NIST incident life cycle. We expect REASSESS to help organizations to select the most appropriate response measure against a detected network-based attack, and hence contribute to mitigate them.

show abstract

“…The aggregation and fusion of alarms should be taken into account by the detection system. This is assumption is in accordance to previous work [17], [24], [25].…”

Section: B Assumptionssupporting

confidence: 81%

Section: Confidencesupporting

confidence: 56%

“…This approach is also described in several other publications of the authors [16], [17], [28] and will be referred as CS-IRS in the following.…”

Section: A Framework For Cost Sensitive Assessment Of Intrusion Rementioning

confidence: 99%

Section: Scenariomentioning

confidence: 99%

Section: A Framework For Cost Sensitive Assessment Of Intrusion Rementioning

confidence: 99%

See 3 more Smart Citations

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

Ossenbuhl¹,

Steinberger

Baier³

2015

2015 Ninth International Conference on IT Security Incident Management &Amp; IT Forensics

View full text Add to dashboard Cite

show abstract

Collaborative DDoS defense using flow-based security event information

Steinberger

Kuhnert²,

Sperotto

et al. 2016

NOMS 2016 - 2016 IEEE/IFIP Network Operations and Management Symposium

View full text Add to dashboard Cite

Over recent years, network-based attacks evolved to the top concerns responsible for network infrastructure and service outages. To counteract such attacks, an approach is to move mitigation from the target network to the networks of Internet Service Providers (ISP). In addition, exchanging threat information among trusted partners is used to reduce the time needed to detect and respond to large-scale network-based attacks. However, exchanging threat information is currently done on an ad-hoc basis via email or telephone, and there is still no interoperable standard to exchange threat information among trusted partners. To facilitate the exchange of security event information in conjunction with widely adopted monitoring technologies, in particular network flows, we make use of the exchange format FLEX. The goal of this paper is to present a communication process that supports the dissemination of threat information based on FLEX in context of ISPs. We show that this communication process helps organizations to speed up their mitigation and response capabilities without the need to modify the current network infrastructure, and hence make it viable to use for network operators.

show abstract

Intrusion detection and response for system and network attacks

Stanley

View full text Add to dashboard Cite

A framework for cost-sensitive automated selection of intrusion response

Cited by 4 publications

References 23 publications

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

Collaborative DDoS defense using flow-based security event information

Intrusion detection and response for system and network attacks

Contact Info

Product

Resources

About