Advanced reaction using risk assessment in intrusion detection systems

Wael Kanoun (1, 2) , Nora Cuppens-Bouhlahia (1, 3) , Frédéric Cuppens (1, 3) , Fabien Autrel (1)

1 LUSSI - Département Logique des Usages, Sciences sociales et Sciences de l'Information
2 Bell Labs (Alcatel Lucent)
3 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance (UMR 3192)

Current intrusion detection systems go beyond the detection of attacks and provide reaction mechanisms to cope with detected attacks or at least reduce their effect. Previous research works have proposed methods to automatically select possible countermeasures capable of ending the detected attack. But actually, countermeasures have side effects and can be as harmful as the detected attack. In this paper, we propose to improve the reaction selection process by giving means to quantify the effectiveness and select the countermeasure that has the minimum negative side effect on the information system. To achieve this goal, we adopt a risk assessment and analysis approach.

Mots clés: Intrusion detection systems; Risk management; Attack scenario; Countermeasure; Potentiality; Impact

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Wael Kanoun, Nora Cuppens-Bouhlahia, Frédéric Cuppens, Fabien Autrel. Advanced reaction using risk assessment in intrusion detection systems. CRITIS'07: 2nd international workshop on Critical Information Infrastructures Security, Oct 2007, Malaga, Spain. ⟨hal-00540863⟩