Towards Automated Incident Handling: How to Select an Appropriate Response against a Network-Based Attack?

Abstract

The increasing amount of network-based attacks evolved to one of the top concerns responsible for network infrastructure and service outages. In order to counteract these threats, computer networks are monitored to detect malicious traffic and initiate suitable reactions. However, initiating a suitable reaction is a process of selecting an appropriate response related to the identified network-based attack. The process of selecting a response requires to take into account the economics of an reaction e.g., risks and benefits. The literature describes several response selection models, but they are not widely adopted. In addition, these models and their evaluation are often not reproducible due to closed testing data. In this paper, we introduce a new response selection model, called REASSESS, that allows to mitigate network-based attacks by incorporating an intuitive response selection process that evaluates negative and positive impacts associated with each countermeasure. We compare REASSESS with the response selection models of IE-IRS, ADEPTS, CS-IRS, and TVA and show that REASSESS is able to select the most appropriate response to an attack in consideration of the positive and negative impacts and thus reduces the effects caused by an network-based attack. Further, we show that REASSESS is aligned to the NIST incident life cycle. We expect REASSESS to help organizations to select the most appropriate response measure against a detected network-based attack, and hence contribute to mitigate them.

Exploiting the Outcome of Outlier Detection for Novel Attack Pattern Recognition on Streaming Data

“…We want to note that much of the alert correlation work, e.g., [49], which relies on misuse-based IDS, assumes that raised alerts can be treated as an attack, i.e., single-stage attack or attack step. Based on those assumptions, a lot of work exists that identifies multistaged attacks by analyzing those alerts.…”

Decision Support for Mission-Centric Cyber Defence

“…They state several propagation patterns in which they consider not only the damage caused by the propagation of dependency's functionality loss but also other types of propagation, such as the propagation of positive effects and propagation of the dependent service's compromise on its dependencies. The response selection model (REASSESS) [13] allows mitigating network-based attacks by incorporating a response selection process that evaluates negative and positive impacts associated with each countermeasure. The considered negative effects are the disturbance of the service caused by the action, which takes into account the importance of the service and the level of disturbance.…”

Incident Reaction Based on Intrusion Detections’ Alert Analysis

“…Many work, for instance [5], make assumptions for response planning that each alert raised by a detection engine is treated as one attack. The aggregation and fusion of alarms should be taken into account by the detection system but they assume 100% confidence of the alerts.…”

“…The alert analysis and planning as well as executing appropriate reactions can no longer be clamped by humans. Also under the circumstances that manual operation cannot guarantee the response time and accuracy, an efficient automatic decision-making support method is desperately needed [5]. New approaches for instance applying machine learning techniques help to handle the detection of massive input data.…”