Real-Time Risk Assessment with Network Sensors and Intrusion Detection Systems

Årnes, André; Sallhammar, Karin; Haslum, Kjetil; Brekne, Tønnes; Moe, Marie Elisabeth Gaup; Knapskog, Svein J.

doi:10.1007/11596981_57

Cited by 41 publications

(37 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [8], a game-theoretic method is used to compute probabilities of expected attacker behavior and these probabilities are used in a transition matrix model to assess security in an interconnected system. In [9], Arnes et al propose a real-time risk assessment method for information systems and networks based on IDS. The system risk is dynamically evaluated using hidden Markov models, providing a mechanism for handling data from sensors with different levels of trustworthiness.…”

Section: Related Workmentioning

confidence: 99%

Dynamic policy-based IDS configuration

Zhu

Başar

2009

Proceedings of the 48h IEEE Conference on Decision and Control (CDC) Held Jointly With 2009 28th Chinese Control Conference

View full text Add to dashboard Cite

Intrusion Detection System (IDS) is an important security enforcement tool in modern networked information systems. Obtaining an optimal IDS configuration for effective detection of attacks is far from trivial. There exists a tradeoff between security enforcement levels and the performance of information systems. It is critical to configure an IDS in a dynamic and iterative fashion to balance the security overhead and system performance. In this paper, we use noncooperative game approaches to address this problem. We first build a fundamental game framework to model the zero-sum interactions between the detector and the attacker. Building on this platform, we then formulate a stochastic game model in which the transitions between system states are determined by the actions chosen by both players. An optimal policy-based configuration can be found by minimizing a discounted cost criterion, using an iterative method. In addition, we propose a Q-learning algorithm to find the optimal game values when the transitions between system states are unknown. We show the convergence of the algorithm to the optimal Q-function and illustrate the concepts by simulation.

show abstract

Section: Related Workmentioning

confidence: 99%

Dynamic policy-based IDS configuration

Zhu

Başar

2009

Proceedings of the 48h IEEE Conference on Decision and Control (CDC) Held Jointly With 2009 28th Chinese Control Conference

View full text Add to dashboard Cite

show abstract

“…The degrees of severities of the different states are obtained from a knowledge base subsystem which extensively explores historical data and expert assessments. The real-time risk R t w for a specific worker w at time t is thus quantified by the following equation [33]:

\begin{matrix} R_{t}^{w} = {false\sum}_{i = 1}^{N} {false\sum}_{j = 1}^{M_{i}} p_{t}^{w} (i, j) \times C (i, j), \end{matrix}

where p t w ( i , j ) is the probability that the worker w is in safety state j associated with hazard i at time t , C ( i , j ) is the cost value (severity) of state j associated with hazard i , N is the number of hazards, and M i is the number of safety states associated with hazard i .…”

Section: Risk Assessment Framework Of Rtsramentioning

confidence: 99%

Real-Time Safety Risk Assessment Based on a Real-Time Location System for Hydropower Construction Sites

Jiang

Lin

Fan

et al. 2014

The Scientific World Journal

View full text Add to dashboard Cite

The concern for workers' safety in construction industry is reflected in many studies focusing on static safety risk identification and assessment. However, studies on real-time safety risk assessment aimed at reducing uncertainty and supporting quick response are rare. A method for real-time safety risk assessment (RTSRA) to implement a dynamic evaluation of worker safety states on construction site has been proposed in this paper. The method provides construction managers who are in charge of safety with more abundant information to reduce the uncertainty of the site. A quantitative calculation formula, integrating the influence of static and dynamic hazards and that of safety supervisors, is established to link the safety risk of workers with the locations of on-site assets. By employing the hidden Markov model (HMM), the RTSRA provides a mechanism for processing location data provided by the real-time location system (RTLS) and analyzing the probability distributions of different states in terms of false positives and negatives. Simulation analysis demonstrated the logic of the proposed method and how it works. Application case shows that the proposed RTSRA is both feasible and effective in managing construction project safety concerns.

show abstract

“…MDPs are related to the types of stochastic models already popular in contemporary dependability/security research [3,4,5,6]. Their focus is to assume that the model parameters (e.g., state transition probabilities & costs) in each decision stage depend explicitly on the control action taken in that stage.…”

Section: Figure 1 An Intrusion Tolerant Systemmentioning

confidence: 99%