A taxonomy of intrusion response systems
International Journal of Information and Computer SecurityPublished 1 January 2007
Natalia Stakhanova, Samik Basu, Johnny Wong
Citations171
SJR quartileQ4
SJR score0.20
SNIP0.30
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This work presents a taxonomy of intrusion response systems, together with a review of current trends in intrusion response research, and provides a set of essential features as a requirement for an ideal intrusion response system.
Abstract
Recent advances in the field of intrusion detection brought new requirements to intrusion prevention and response. Traditionally, the response to an attack is manually triggered by an administrator. However, increased complexity and speed of the attack-spread during recent years show acute necessity for complex dynamic response mechanisms. Although intrusion detection systems are being actively developed, research efforts in intrusion response are still isolated. In this work we present a taxonomy of intrusion response systems, together with a review of current trends in intrusion response research. We also provide a set of essential features as a requirement for an ideal intrusion response system.
Keywords
Computer ScienceEngineering
Intrusion Detection Systems: A Survey and Taxonomy
758 Citations2002Stefan Axelsson
The taxonomy consists of a classification first of the detection principle, and second of certain operational aspects of the intrusion detection system as such, which are used predictively to survey and classify a number of research prototypes.
EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances
708 Citations2002Phillip Porras, Peter G. Neumann +1 more
Auerbach Publications eBooksInformation Security Risk Analysis
342 Citations2005Thomas R. Peltier, Thomas R. Peltier
Journal of Computer SecurityToward cost-sensitive modeling for intrusion detection and response
282 Citations2002Wenke Lee, Wei Fan +3 more
This paper defines cost models to formulate the total expected cost of an IDS, and presents cost-sensitive machine learning techniques that can produce detection models that are optimized for user-defined cost metrics.
Automated response using system-call delays
244 Citations2000Anil Somayaji, Stephanie Forrest
The paper presents the rationale for pH, its design and implementation, and a set of initial experimental results which can successfully detect and stop intrusions before the target system is compromised.
IEEE NetworkCooperating security managers: a peer-based intrusion detection system
220 Citations1996Gregory B. White, Eric A. Fisch +1 more
Cooperating security managers (CSM) is designed to perform intrusion detection and reporting functions in a distributed environment without requiring a designated central site or server to perform the analysis of network audit data.
International journal of network securityRESEARCH ON INTRUSION DETECTION AND RESPONSE: A SURVEY
220 Citations2005Peyman Kabiri, Ali A. Ghorbani
A review on current trends in intrusion detection together with a study on technologies implemented by some researchers in this research area are provided.
Experience with EMERALD to Date
212 Citations1999Peter G. Neumann, Phillip Porras
Building a Reactive Immune System for Software Services
170 Citations2004Stelios Sidiroglou, Michael E. Locasto +2 more
The overall system architecture and a prototype implementation for the x86 platform are discussed, and the preliminary performance evaluation shows that although full emulation can be prohibitively expensive, selective emulation can incur as little as 30% performance overhead relative to an uninstrumented (but failure-prone) instance of Apache.
Lecture notes in computer scienceExperiences with Specification-Based Intrusion Detection
152 Citations2001Prem Uppuluri, R. Sekar
These experiments show that an effective specification-based IDS can be developed with modest efforts and live up to their promise of detecting known as well as unknown attacks, while maintaining a very low rate of false positives.
Evaluating the impact of automated intrusion response mechanisms
148 Citations2003Thomas Toth, Christopher Kruegel
A network model and an algorithm are presented that allows the IRS to select the response among several alternatives which fulfills the security requirements and has a minimal negative effect on legitimate users.
ADEPTS: Adaptive Intrusion Response Using Attack Graphs in an E-Commerce Environment
146 Citations2005Bingrui Foo, Yu‐Sung Wu +3 more
This paper presents the design of automated response mechanisms in an intrusion tolerant system called ADEPTS, which focuses on enforcing containment in the system, thus localizing the intrusion and allowing the system to provide service, albeit degraded.
Infrastructure for intrusion detection and response
144 Citations2002D. Schnackenberg, K. Djahandari +1 more
An overview of the intruder detection and isolation protocol (IDIP) architecture and how it supports the need for an intrusion detection and response infrastructure is provided.
IFIP advances in information and communication technologySleepy Watermark Tracing: An Active Network-Based Intrusion Response Framework
139 Citations2001Xinyuan Wang, Douglas S. Reeves +2 more
This paper applies active networking principles to address the problem of tracing net-work-based intrusion with such chained connections, and proposes a novel intrusion response framework: Sleepy Watermark Tracing (SWT), which is "sleepy" in that it does not introduce overhead when no intrusion is detected.
Lecture notes in computer scienceUsing Specification-Based Intrusion Detection for Automated Response
130 Citations2003Ivan Balepin, Sergei Maltsev +2 more
This work starts addressing the problem by coupling automated response with specification-based, host-based intrusion detection, and describes the system map, and the map-based action cost model that give the basis for deciding on response strategy.
Adaptation techniques for intrusion detection and intrusion response systems
93 Citations2002Daniel Ragsdale, Curtis A. Carver +2 more
Intervention detection and response systems to dynamically adapt to better detect and respond to attacks will provide more robust protection than static, non-adaptive systems.
Cooperative Intrusion Traceback and Response Architecture (CITRA)
88 Citations2002D. Schnackengerg, Harley Holliday +3 more
This paper provides an overview of CITRA policy mechanisms and how CITra integrates diverse security technologies to improve system defense.
Lecture notes in computer scienceFLIPS: Hybrid Adaptive Intrusion Prevention
77 Citations2006Michael E. Locasto, Ke Wang +2 more
This work presents FLIPS (Feedback Learning IPS), a hybrid approach to host security that prevents binary code injection attacks, and describes a prototype that protects HTTP servers, but FLIPS can be applied to a variety of server and client applications.
A Methodology for Using Intelligent Agents to provide Automated Intrusion Response
63 Citations2000Curtis A. Carver, John M. Hill +2 more
This paper proposes a new methodology for adaptive, automated intrusion response (IR) using software agents that collaborate to protect the computer system against attack and adapt their response tactics until the system administrator can take an active role in the defense of the system.
Building survivable systems: an integrated approach based on intrusion detection and damage containment
55 Citations2002Thomas F. Bowen, Dana Chee +4 more
A new approach that combines early attack detection with automated reaction for damage prevention and containment, as well as tracing and isolation of attack origination point(s), based on specifying security-relevant behaviors using patterns over sequences of observable events.
SARA: Survivable Autonomic Response Architecture
55 Citations2002Scott M. Lewandowski, Dan Hook +3 more
The architecture of a system being developed to defend information systems using coordinated autonomic responses and the system will also be used to test the hypothesis that an effective defense against fast, distributed information attacks requires rapid, coordinated, network-wide responses.
Tracing Based Active Intrusion Response
28 Citations2002Xinyuan Wang, Douglas S. Reeves +1 more
This work states that existing intrusion defense approaches such as intrusion prevention, detection, tolerance and response are “passive” in response to network-based intrusions in that their countermeasures are limited to being local to the intrusion target and there is no automated, network-wide counteraction against detected intrusions.
System or security managers adaptive response tool
25 Citations2002S. Mnsman, P. Flesher
The design and function of a system being developed under a DARPA SBIR Phase I and II project for Adaptive Network and Security Management is described, which combines an agent architecture and Case-based reasoning (CBR) with available system management or security tools.