Adaptive Intrusion Response to Minimize Risks over
| Venue: | Network Attacks”, ACM Trans. on Information and System Security |
| Citations: | 2 - 0 self |
BibTeX
@INPROCEEDINGS{Tanachaiwiwat_adaptiveintrusion,
author = {Sapon Tanachaiwiwat and Kai Hwang and Yue Chen},
title = {Adaptive Intrusion Response to Minimize Risks over},
booktitle = {Network Attacks”, ACM Trans. on Information and System Security},
year = {}
}
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract: A new risk-minimizing security model is presented for distributed network intrusion detection with automated responses. The scheme is based on collective risk assessment of multiple attacks on a network. We propose a new adaptive alarm/defense framework in protecting network resources. We have tested the adaptive security framework on a small Linux cluster at USC. The desired security functions are distributed to routers, switches, firewalls, and hosts. Adaptive response strategies are suggested based on the alarm confidence, attack frequency, assessed risks, and estimated response costs. Dynamic security is achieved by frequent policy update against changing attack patterns or varying network conditions. Measured false alarms and detection rate are used in the armed response decision process. This paper reports the theoretical framework and experimental results obtained. Lessons learned from this network security project are presented.
