Towards cost-sensitive assessment of intrusion response selection

Abstract

In recent years, cost-sensitive intrusion response has gained significant interest mainly due to its emphasis on the balance between potential damage incurred by the intrusion and cost of the response. However, one of the challenges in applying this approach is defining consistent and adaptable measurements of these cost factors on the basis of requirements and policy of the system being protected against intrusions.In this paper we present a framework for the cost-sensitive selection of intrusion response. Specifically, we introduce a set of measurements that characterize potential costs associated with the intrusion handling process and propose evaluation method of intrusion response with respect to the risk of potential intrusion damage, effectiveness of response action and response cost for a system. We provide an implementation of the proposed solution as a plugin tool for Snort IDS and demonstrate its advantages on DARPA data set and real network traffic.

Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

“…Therefore an implicit assumption is, that the structure of the intrusion graph is fairly stable. The authors in study [16] reported, deploying ADEPTS in a different setting might require significant modifications. Therefore the system independency of ADEPTS is considers as medium.…”

“…We found that the comparison of these approaches is difficult because some approaches are only applicable for specific system environments [16]. Another circumstance that affirm this problem is that each of the presented approaches is using different metrics, e.g the response model IE-IRS proposed by [18] only considers negative side effects of a response deployment, while the response model ADEPTS [26] considers the positive effects.…”

“…This approach is also described in several other publications of the authors [16], [17], [28] and will be referred as CS-IRS in the following.…”

“…Traditionally, automated mitigation and response processes make use of a Intrusion Response System (IRS) that provides a distinct response selection process [15], and is able to collaborate with other security appliances, such as firewalls to block and terminate suspicious traffic [8]. Although IRSs are promising systems, available solutions proposed by the scientific community are not widely adopted [16]. Further, each IRS uses different metrics to select an appropriate response and some of the metrics are only applicable for specific system environments.…”

Selection of Pareto-efficient response plans based on financial and operational assessments

“…[35], [36], and Fiedler [37] consider a defender-attacker interaction as strategic games and present well-formalized definitions and well-defined problems for winning these games based on a cost optimization. Other cost-focused approaches are proposed in [32,36,38,39]. However, only considering the cost of implementation has a significant drawback: as mentioned in the beginning, the cost of shutting down a highly critical node will certainly eliminate an attack surface and involves almost no costs at all for implementation.…”