Risk-Aware Framework for Activating and Deactivating Policy-Based Response

Abstract

With the growth of modern systems and infrastructures, automated and intelligent response systems become the holy grail of the security community. An interesting approach proposes to use dynamic access control policies to specify response policies for such systems. These policies should be enforced when an ongoing attack, that threatens the monitored system, is detected. However, existing work do not present a clear methodology to specify the Response policies. In particular, the deactivation issue is not yet tackled. In this paper, we first present how to specify response policies. Second, a risk-aware framework is proposed to activate and deactivate response policies. Hence, the success likelihood of the threat, and the cumulative impact of both of the threat and the response, are all considered.

Network defence strategy evaluation: Simulation vs. live network

“…In the simulation scenarios, the sources of the attacks are usually either replayed attacks [5], [6], [7] or simulated attacks based on attack vectors [8], [9]. All of the works evaluate only the strategy performance except for Strasburg et al [6], who evaluate the performance and scalability of the strategy, and Wang et al [9], who vary simulation parameters to test the performance, sensitivity and scalability.…”

ORCEF: Online response cost evaluation framework for intrusion response system

“…The majority of the proposed IRS use Static Cost or Static Evaluated Cost models (Curtis and Carver, 2001;White et al, 1996;Strasburg et al, 2009;Lee et al, 2002;Stakhanova et al, 2007;Mu and Li, 2010;Wang and Elhag, 2006;Fisch, 1996;Porras and Neumann, 1997;Bowen et al, 2000;Musman and Flesher, 2000;Somayaji and Forrest, 2000;Lewandowski et al, 2001;Schnackenberg et al, 2001;Wang et al, 2001;Tanachaiwiwat et al, 2002;Foo et al, 2005;Papadaki and Furnell, 2006;Kanoun et al, 2010). In contrast, a few models have been presented in the third category, dynamic evaluated cost (Toth and Kregel, 2002;Balepin et al, 2003;Kheir et al, 2010).…”

Awareness and reaction strategies for critical infrastructure protection

“…Also based on modeling, the risk-aware framework proposed in [18] contains an online component which measures the likelihood of success of an ongoing threat or attack, and the cumulative impacts (cost) of the threat and the response. These measures help the RS determine the need for activation or deactivation of the system's policies as countermeasures.…”

“…Here, in order to make the IDPRS more precise, risk assessment should be conducted dynamically (online). There are systems in the literature capable of tackling risk assessment in different scenarios, varying from general purpose environments [11,16,17] to complex cyber-physical infrastructures such as the telecommunications industry or the smart grid [18,19].…”

“…Each goal has its own sequence of responses according to the risks they imply, e.g., weak responses earlier in time, and strong responses later. Kanoun et al presented in [18] a risk-aware framework composed of an online model and its architecture, which allows activating or deactivating response policies. They focus on the need of having deactivation mechanisms which allow the RS to stop applying responses when it calculates that the impact of the reaction surpasses an sufficient threshold.…”