Intrusion Response Systems: A Survey

Foo, Bingrui; Glause, Matthew W.; Howard, Gaspar Modelo; Wu, Yu-Sung; Bagchi, Saurabh; Spafford, Eugene H.

doi:10.1016/b978-012373566-9.50015-x

Cited by 20 publications

(5 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A number of techniques aimed at enhancing intrusion response automation have been proposed and deployed, and a comprehensive review of this research work is given in taxonomies by Natalia Stakhanova [23], and Bingrui Foo [5].…”

Section: Chapter 2 Related Workmentioning

confidence: 99%

A framework for cost-sensitive automated selection of intrusion response

Strasburg

View full text Add to dashboard Cite

Section: Chapter 2 Related Workmentioning

confidence: 99%

A framework for cost-sensitive automated selection of intrusion response

Strasburg

View full text Add to dashboard Cite

“…Hence, it is necessary to decrease the amount of human intervention required by automating some of the tasks commonly carried out by it. In [7,22], it is highlighted that IPS and Intrusion Response Systems (IRS) may require human tuning in order to decide which preventive actions to enable/disable for which type of alert. This tuning ensures that undesired reactive actions that may compromise the behaviour of the underlying system are not executed.…”

Section: Configurability and Automatic Or Semi-automatic Reactions Tomentioning

confidence: 99%

Towards Industrial Intrusion Prevention Systems: A Concept and Implementation for Reactive Protection

Martinez

Vogel‐Heuser

2018

Applied Sciences

View full text Add to dashboard Cite

Featured Application: The paper presents a concept to actively and automatically respond to security intrusions in Industrial Automation Systems. It is comprised of reactive actions, and security and operational policies that consider both security and architectural trends of this kind of systems. This concept is of significance to system stakeholders that wish to increase the security of their system by implementing automatic and active protection.Abstract: System intrusions violate the security of a system. In order to maintain it, it is necessary to decrease the chances of intrusions occurring or by detecting them as soon as they ensue in order to respond to them in a timely manner. These responses are divided in two types: passive or reactive responses. Passive responses are limited to only notification and alerting; whereas, reactive responses influence the intrusion by undoing or diminishing its consequences. Unfortunately, some reactive responses may influence the underlying system where the intrusion has occurred. This is especially a concern in the field of Industrial Automation Systems, as these systems are critical and have a well-defined set of operational requirements that must be maintained. Hence, automatic reactive responses are often not considered or are limited to human intervention. This paper addresses this issue by introducing a concept for reactive protection that integrates the automatic execution of active responses that do not influence the operation of the underlying Industrial Automation System. This concept takes into consideration architectural and security trends, as well as security and operational policies of Industrial Automation Systems. It also proposes a set of reactive actions that can be taken in the presence of intrusions in order to counteract them or diminish their effects. The feasibility and applicability of the presented concept for Industrial Automation Systems is supported by the implementation and evaluation of a prototypical Reactive Protection System.

show abstract

“…Network intrusion response mechanisms have been intensively studied in recent years due to their importance in cyber security. Some scholars design automated response mechanism to deploy the appropriate responses . Considering the conflicting interests of the decision makers, game theoretical approach is used by many researchers to find strategies for both the defender and the attacker.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

A fictitious play‐based response strategy for multistage intrusion defense systems

Luo

Szidarovszky

Al-Nashif

et al. 2013

Security Comm Networks

View full text Add to dashboard Cite

The recent developments of advanced intrusion detection systems in the cyber security field provide opportunities to proactively protect the computer network systems and minimize the impacts of attackers on network operations. This paper is intended to assist the network defender find its best actions to defend against multistage attacks. The possible sequences of interactions between the attackers and the network defender are modeled as a two‐player non‐zero‐sum non‐cooperative dynamic multistage game with incomplete information. The players are assumed to be rational. They take turns in making decisions by considering previous and possible future interactions with the opponent and use Bayesian analysis after each interaction to update their knowledge about the opponents. We propose a Dynamic game tree‐based Fictitious Play (DFP) approach to describe the repeated interactive decisions of the players. Each player finds its best moves at its decision nodes of the game tree by using multi‐objective analysis. All possibilities are considered with their uncertain future interactions, which are based on learning of the opponent's decision process (including risk attitude and objectives). Instead of searching the entire game tree, appropriate future time horizons are dynamically determined for both players. In the DFP approach, the defender keeps tracking the opponent's actions, predicts the probabilities of future possible attacks, and then chooses its best moves. Thus, a new defense algorithm, called Response by DFP (RDFP), is developed. Numerical experiments show that this approach significantly reduces the damage caused by multistage attacks and it is also more efficient than other related algorithms. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

Intrusion Response Systems: A Survey

Cited by 20 publications

References 28 publications

A framework for cost-sensitive automated selection of intrusion response

A framework for cost-sensitive automated selection of intrusion response

Towards Industrial Intrusion Prevention Systems: A Concept and Implementation for Reactive Protection

A fictitious play‐based response strategy for multistage intrusion defense systems

Contact Info

Product

Resources

About