Intelligent response system to mitigate the success likelihood of ongoing attacks

Wael Kanoun (1, 2) , Nora Cuppens-Boulahia (1, 3) , Frédéric Cuppens (1, 3) , Samuel Dubus (2) , Antony Martin (2)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 Alcatel-Lucent Bell Labs France [Nozay]
3 Lab-STICC_TB_CID_SFIIS

Intrusion response models and systems have been recently an active field in the security research. These systems rely on a fine diagnosis to perform and optimize their response. In particular, previous papers focus on balancing the cost of the response with the impact of the attack. In this paper, we present a novel attack response system, based on the assessment of the likelihood of success of attack objectives. First, the ongoing potential attacks are identified, and their success likelihood are calculated dynamically. The success likelihood depends mainly on the progress of the attack and the state of the monitored system. Second, candidate countermeasures are identified, and their effectiveness in reducing the pre-calculated success likelihood are assessed. Finally, the candidate countermeasures are prioritized.

Mots clés: Success likelihood; Response; Attack objective; Dynamic Markol model

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Wael Kanoun, Nora Cuppens-Boulahia, Frédéric Cuppens, Samuel Dubus, Antony Martin. Intelligent response system to mitigate the success likelihood of ongoing attacks. IAS 2010 : 6th IEEE International Conference on Information Assurance and Security, Aug 2010, Atlanta, United States. ⟨hal-00540838⟩