Abstract-In recent years, information systems have become more diverse and complex making them a privileged target of network and computer attacks. These attacks have increased tremendously and turned out to be more sophisticated and evolving in an unpredictable manner. This work presents an attack model called AIDD (Attacks Identification Description and Defense). It offers a generic attack modeling to classify, help identify and defend against computer and network attacks. Our approach takes into account several attack properties in order to simplify attack handling and aggregate defense mechanisms. The originality in our work is that it introduces a target centric classification which increases the level of abstraction in order to offer a generic model to describe complex attacks.Keywords-attack modeling, attack taxonomy, attack classification, attack detection, network and web attacks, defense mechanisms

International audienceAttacks on information systems have increased tremendously and have become more diverse and complex. Evolving in an unpredictable manner and having devastating outcomes, the detection and the selection of appropriate countermeasures has become a priority for security analysts. This paper introduces a classification-based Attack Detection system which provides a framework to evaluate, identify, classify and defend against sophisticated attacks. Our approach helps simplify complex rules' expression and alert handling, thanks to a modular architecture and an intuitive rules defining with a high power of expression language. The proposed system is flexible and takes into account several attack properties in order to simplify attack handling and aggregate defense mechanisms

No abstract

International audienceThis paper introduces an attack detection and response system based on multi-level rule expression language. It provides a framework to evaluate, identify, classify and defend against sophisticated attacks. Our approach helps simplifying complex rules' expression and alert handling, thanks to a modular architecture and an intuitive rules along with a powerful expression language. The proposed system is flexible and takes into account several attack properties in order to simplify attack handling and aggregate defense mechanisms. 1 Introduction Security aims at protecting firm resources from undesired access by users and applications. Improving security in enterprise information system relies on analyzing threats, risks and vulnerabilities to specify appropriate countermeasures. This imposes several challenges to tackle with security issues. One of these challenges is detection and mitigation of attacks. To deal with the growing complexity of new attacks, several solutions such as intrusion detection and prevention systems (IDS/IPS) and web application firewalls (WAF) have been proposed. These solutions can be based either on signature or on behavior detection. They play an important role in countering security threats. Signature based system tend to use static rules and to detect only specific attacks or anomalous behaviors that are already known. In anomaly-based case, they need learning process and detection is more complex. In addition, attack detection techniques are far from being satisfactory [1]. In fact, solutions like IDSs provide unmanageable amount of " false positives " alarms which are hard to inspect. Furthermore, many detection systems do not offer an appropriate compromise between acceptable performance and detection language simplicity

In recent years, computer and network attacks have increased tremendously. They turned out to be more sophisticated, complex and evolving in an unpredictable manner. This work presents a novel attack classification. It offers a generic attack description to classify, help identify and defend against computer and network attacks. Our approach takes into account several attack properties in order to simplify attack handling and aggregate defense mechanisms. The originality of our work is the introduction of a target centric classification. It increases the level of abstraction in order to offer a generic model to describe complex attacks. This classification will help enhance attack detection and provide the appropriate defense mechanisms matching.