Security novel risk assessment framework based on reversible metrics: a case study of DDoS attacks on an E‐commerce web server

Abstract

Summary Network security management is a complex and costly task. This is due to the diversity and the large number of assets to protect from potential threats. It is difficult for enterprises to ensure complete security of their information technology resources. They need to give priority to critical and vulnerable assets. Thus, for each asset, they assess the risks associated with various threats. Then, depending on risk level, they can decide which asset needs a particular security treatment. In this paper, we propose a novel risk assessment framework based on a set of reversible metrics. It is based on new metrics for the likelihood and impact parameters. These metrics have as a primary objective to solve the problem of weighting the risk factors that lead to different risk values. The proposed metrics are classified and aggregated to provide a unique risk metric. We are using a new bitwise method for aggregating called ‘bit alternation’. This method ensures the reversibility of the likelihood and impact metrics. It has many advantages: unifying metrics, diagnosing the cause of high risks, comparing the values of the risk calculated with different weighting strategies, exchanging standard risk values, etc. To illustrate our method, we have applied it to assess risks of some distributed denial of service attacks for an e‐commerce enterprise that wants to see the level of security of its retail web server. To demonstrate the effectiveness of our results, we have compared them with those obtained by the weighted average method. Copyright © 2016 John Wiley & Sons, Ltd.

Risk based intrusion detection system in software defined networking

“…We propose to classify the value of each metric (standard and proposed) before aggregating them. We use the following scale: low (00), medium (01), high (10), or excellent (11). Then, we use the bit alternation method (see Figure 3) to obtain a unique binary sequence that will be converted into a decimal value.…”

“…In order to comprehend the risk assessment method, it is first necessary to understand a few fundamental concepts 11 Risk model: In this work, we will be inspired by the model presented in Reference 11, we will extend and adapt it to our needs. The risk is viewed as a tree of parameters (Figure 2).…”

“… Risk evaluation: After determining the different types of vulnerabilities of the institution and the intrusion types that the institution would like to protect itself against (see $$$ P $$$ Section 3), we propose a risk evaluation method where we determine the risk of each type of intrusion (step A.3 Figure 4). Then, we classify the different risk values in order to obtain the set of severity $$$ S $$$ associated with each intrusion in $$$ P $$$.In order to compute the risk values, we have extended the risk model presented in Reference 11 (see Figure 2) by integrating the Countermeasure parameter. Countermeasures can be any attribute or process used to reduce the Impact or the Likelihood of threats.…”

“…We extend the risk model to adapt it to the specificities of the SDN environment. The proposed extension of the risk model 11 is presented in Figure 5 by the red box. We use three metrics to evaluate the risk.…”

“…In order to compute the risk values, we have extended the risk model presented in Reference 11 (see Figure 2) by integrating the Countermeasure parameter. Countermeasures can be any attribute or process used to reduce the Impact or the Likelihood of threats.…”