AIDD: A novel generic attack modeling approach

Abstract

Abstract-In recent years, information systems have become more diverse and complex making them a privileged target of network and computer attacks. These attacks have increased tremendously and turned out to be more sophisticated and evolving in an unpredictable manner. This work presents an attack model called AIDD (Attacks Identification Description and Defense). It offers a generic attack modeling to classify, help identify and defend against computer and network attacks. Our approach takes into account several attack properties in order to simplify attack handling and aggregate defense mechanisms. The originality in our work is that it introduces a target centric classification which increases the level of abstraction in order to offer a generic model to describe complex attacks.Keywords-attack modeling, attack taxonomy, attack classification, attack detection, network and web attacks, defense mechanisms

A Novel Security Architecture Based on Multi-level Rule Expression Language

“…In fact, we propose a generic approach to define Attack categories based on our attack classification [2]. These categories will be the base of our detection process.…”

“…However, the current paper focuses only on the architectural aspects such as modularity, flexibility, extendibility, expressiveness, and simplicity of use in a heterogeneous environments. We have already dealt with modeling issues in a previous work [2]. The objective of this work is to bring a level of abstraction that makes the detection of complex attacks more feasible and the detection rules and security policy definition simpler.…”

Toward a novel classification-based attack detection and response architecture

“…Finally, we define a Detection Database that contains all the information needed: attack classification scheme, detection rules, Attack scenarios and queries. In fact, we propose a generic approach to define Attack categories based on our attack classification [2]. These categories will be the base of our detection process.…”

“…In our context, attack modeling is crucial to the detection process, as it is closely related to the choice of implemented rules and attack detection parameters. This was the topic of our previous work [2]. The current paper focuses only on the architectural aspects showing how to bring a level of abstraction to make the detection of complex attacks more feasible and the detection rules and security policy defining process simpler.…”

Toward a novel rule-based attack description and response language

“…In our context, our proposal is based on an attack classification from the defender point of view [2] that helps describe the manifestation of the attack in a high level manner. Our proposed language describes an attack and associates the appropriate response according to the context and the defined security policy.…”