A real-time risk assessment model for intrusion detection systems

Chakir, El Mostapha; Moughit, Mohamed; Khamlichi, Youness Idrissi

doi:10.1109/isncc.2017.8071990

Cited by 3 publications

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

A systematic review on intrusion detection based on the Hidden Markov Model

Ramaki

Rasoolzadegan

Jafari

2018

Statistical Analysis

View full text Add to dashboard Cite

Apart from using traditional security solutions in software systems such as firewalls and access control mechanisms, utilizing intrusion detection systems are also necessary. Intrusion detection is a process in which a set of methods are used to detect malicious activities against the victims. Many techniques for detecting potential intrusions in software systems have already been introduced. One of the most important techniques for intrusion detection based on machine learning is using Hidden Markov Models (HMM). In recent decades, many research communities have been working toward HMM-based intrusion detection. Therefore, a large volume of research works has been published and hence, various research areas have emerged in this field. However, until now, there has been no systematic and up-to-date review of research works within the field. This paper aims to survey the research in this field and provide open problems and challenges based on the analysis of advantages, limitations, types of architectural models, and applications of current techniques. Six various architecture models for intrusion detection purposes are proposed in the literature. We compare these models based on performance criteria in order to select an appropriate type for a specific application. The results show that HMM-based intrusion detection techniques have 6 main advantages-precise intrusion detection, ability to detect new and unknown intrusions, prediction of the intruder's potential next steps, usage in real-time applications by processing data streams on-the-fly, usage of heterogeneous data sources as input, and visual representation of acquired knowledge relative to the other techniques of machine learning. KEYWORDSHidden Markov Model, intrusion detection, intrusion detection system, statistical learning, system and network security

show abstract

A systematic review on intrusion detection based on the Hidden Markov Model

Ramaki

Rasoolzadegan

Jafari

2018

Statistical Analysis

View full text Add to dashboard Cite

show abstract

A Dynamic Risk Assessment (DRA) Methodology for High Impact Low Probability (HILP) Security Risks

Dambra¹,

Graf²,

Arias

et al. 2019

Critical Information Infrastructures Security

View full text Add to dashboard Cite

An Indicators-of-Risk Library for Industrial Network Security

Adaros-Boye

Kearney

Josephs

et al. 2021

Proceedings of the 16th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

This paper introduces an "Indicator of Risk (IoR) Library" that leverages the MITRE ATT&CK for Industrial Control Systems (ICS) knowledge base to support continuous risk monitoring. This allows also making use of variables that are already being monitored to analyse risks in a continuous basis. IoRs broaden the concept of Indicators of Compromise by combining detection strategies with probabilistic inference as a tool for quantifying cyber-security risks. The latest version of the Library has 95 IoRs and has been reviewed by professionals from three major companies and cross-referenced against detection use-cases implemented by other researchers to validate its potential to identify variables for monitoring cyber-risks in ICS.

show abstract

A real-time risk assessment model for intrusion detection systems

Cited by 3 publications

References 19 publications

A systematic review on intrusion detection based on the Hidden Markov Model

A systematic review on intrusion detection based on the Hidden Markov Model

A Dynamic Risk Assessment (DRA) Methodology for High Impact Low Probability (HILP) Security Risks

An Indicators-of-Risk Library for Industrial Network Security

Contact Info

Product

Resources

About