Foresight Framework for Intrusion Response Systems in Computer Networks

Q: How can I download an article?

To download an article from SID, first log in to the site, search for the article title, and click on the 'Download Article' option.

Q: How can I download an ISI article?

To download an ISI article on SID, enter the keyword or article title in the search bar, view the relevant results, click on the desired article, and select the 'Download Article' option.

Q: How can I access the SID database?

To access the SID database, visit SID.ir, create an account, and log in to access scientific resources.

Q: Is downloading articles from SID free?

Some articles on SID are available for free, while others require payment. Details are specified on the article's page.

GHASEMI GOL M.

Scientific Information Database (SID) - Trusted Source for Research and Academic Resources

Journal Paper

Paper Information

Journal: JOURNAL OF ELECTRONIC AND CYBER DEFENCE Year:2018 | Volume:6 | Issue:3 (23) Page(s): 13-34

Download Full-Text

View:

174

Download:

Cites:

Information Journal Paper

Title

Foresight Framework for Intrusion Response Systems in Computer Networks

Author(s)

GHASEMI GOL M. | Issue Writer Certificate

Keywords

Intrusion Response System

Foresight

Alert Management

Uncertainty-aware Attack Graph

Network Dependency Graph

Markov Decision Process

Abstract

Today, the number of alerts issued by network security systems has increased significantly and network administrators encounter new problems in handling the issued alerts and responding to them. As managing and responding to such a large number of alerts is difficult, Alert Management and Intrusion Response System (IRS) are the main part of the security protection systems including intrusion detection systems. The main task of Alert Management is to reveal the attack details to IRS. Subsequently, the appropriate responses are applied to reduce the attack damage and recover the compromised computer networks back to their normal operational mode. In the literature, researchers have investigated Alert Management techniques and IRS solutions separately, despite the fact that Alert Management is one of the basic requirements of response process and its outcome directly affects the IRS performance. Alert Management design should provide the necessary information about the attacks to the response system according to its type and requirements. This information along with information from network resources present the current state of the network to IRS. However, if decisions taken by the response system is only based on the current network status, the total cost of the network will increase over the time. Therefore with a futuristic concept and considering the present available information and all possible coming states, decision making process in the response system can be improved. In this paper, using a futuristic approach we seek to propose optimal solutions for confronting already-occurred and future-probable attacks. To achieve this goal, the proposed framework contains two subsystems: attacks and alerts modeling, and response modeling. In the first subsystem, we analyze the IDS alerts to find the similarity and causality relationships. We also present a comprehensive approach for network attack forecasting to obtain some useful predictions about the future states of the network. In the second subsystem, the response analyzer presents a multilevel response model to categorize intrusion responses. It also provides a Foresight model to estimate the response cost by considering IDS alerts, network dependencies, attack damage, response impact, and the probability of potential attacks. Finally, models are proposed to make the best decision based on available information about the present and all possible coming states. Simulation results for different scenarios show that the response system, with a prospective vision, steers the network toward desired states with reduced cost of attack and response.

Cites

No record.

References

No record.

Cite

APA: Copy

GHASEMI GOL, M.. (2018). Foresight Framework for Intrusion Response Systems in Computer Networks. JOURNAL OF ELECTRONIC AND CYBER DEFENCE, 6(3 (23) ), 13-34. SID. https://sid.ir/paper/729852/en

Vancouver: Copy

GHASEMI GOL M.. Foresight Framework for Intrusion Response Systems in Computer Networks. JOURNAL OF ELECTRONIC AND CYBER DEFENCE[Internet]. 2018;6(3 (23) ):13-34. Available from: https://sid.ir/paper/729852/en

IEEE: Copy

M. GHASEMI GOL, “Foresight Framework for Intrusion Response Systems in Computer Networks,” JOURNAL OF ELECTRONIC AND CYBER DEFENCE, vol. 6, no. 3 (23) , pp. 13–34, 2018, [Online]. Available: https://sid.ir/paper/729852/en

Related Journal Papers

No record.

Related Seminar Papers

No record.

Related Plans

No record.

Recommended Workshops