NAIR: A novel automated intrusion response system based on decision making approach

In recent years, automated intrusion response has become a promising research problem in network security. Several approaches have been proposed to perform an effective automated response policy. However, these approaches have some limitations, i.e., heavily depending on attack alerts and not taking...

Full description

Saved in:
Bibliographic Details
Main Authors: Xin Zan, Feng Gao, Jiuqiang Han, Xiaoyong Liu, Jiaping Zhou
Format: Conference Proceeding
Language:English
Subjects:
automated intrusion response
Automation
component
Cost function
cost function analysis
Decision making
Engines
Game theory
Hidden Markov models
HMM
Intrusion detection
POMDP
Robustness
Security
Uncertainty
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In recent years, automated intrusion response has become a promising research problem in network security. Several approaches have been proposed to perform an effective automated response policy. However, these approaches have some limitations, i.e., heavily depending on attack alerts and not taking in account uncertainty of system runtime state. In this paper, we present a comprehensive sequential decision-making based automated intrusion response approach. We utilize different decision approaches and models to respectively represent and reason about attack activities and system runtime state in view of their different dynamic nature. We perform some experiments to validate proposed approach and the results show that our approach has good performance in response accuracy to different attack scenarios and robustness against false alerts.
DOI:10.1109/ICINFA.2010.5512396