A Retroactive-Burst Framework for Automated Intrusion Response System

Abstract

The aim of this paper is to present an adaptive and cost-sensitive model to prevent security intrusions. In most automated intrusion response systems, response selection is performed locally based on current threat without using the knowledge of attacks history. Another challenge is that a group of responses are applied without any feedback mechanism to measure the response effect. We address these problems through retroactive-burst execution of responses and a Response Coordinator (RC) mechanism, the main contributions of this work. The retroactive-burst execution consists of several burst executions of responses with, at the end of each burst, a mechanism for measuring the effectiveness of the applied responses by the risk assessment component. The appropriate combination of responses must be considered for each burst execution to mitigate the progress of the attack without necessarily running the next round of responses, because of the impact on legitimate users. In the proposed model, there is a multilevel response mechanism. To indicate which level is appropriate to apply based on the retroactive-burst execution, we get help from a Response Coordinator mechanism. The applied responses can improve the health of Applications, Kernel, Local Services, Network Services, and Physical Status. Based on these indexes, the RC gives a general overview of an attacker’s goal in a distributed environment.

Hidden Markov Model and Cyber Deception for the Prevention of Adversarial Lateral Movement

“…The finite states machine (FSM) model is used in [22] to design a multi-attack response system. The model sends an alert only after there is a state change without predicting the whole attack path.…”

Multi‐scale navigation of large trace data: A survey

“…Intrusion detection systems analyze network packets and look at their payload to find and detect attack signatures. Similar to intrusion detection systems, trace analysis tools, upon detecting such a problematic pattern, may generate an alarm or even trigger an automatic response (eg, killing a process and rebooting the system) …”

“…1 Similar to intrusion detection systems, trace analysis tools, upon detecting such a problematic pattern, may generate an alarm or even trigger an automatic response (eg, killing a process and rebooting the system). 68 One of the other techniques to reduce trace complexity and improve understanding is visualization. A proper visualization, specially multi-scale visualization, can significantly help to alleviate big data analysis problems, as investigated in the next section.…”

Optimal Security Protection Strategy Selection Model Based on Q-Learning Particle Swarm Optimization

“…Recently, a hot research topic in the protection strategies for ICS has been to focus on the active protection, which implements active protection strategies based on the risk assessment on the current security risk of the ICS. Shameli-Sendi et al proposed a retrospective burst response method based on an adaptive and cost-sensitive model [ 16 ]. This method takes into account the effectiveness of the application response.…”