V-COPS: A Vulnerability-Based Cooperative Alert Distribution System

The efficiency of promptly releasing security alerts of established analysis centers has been greatly challenged by the continuous emergence of various large scale network attacks, such as worms. With a limited number of sensors deployed over the Internet and a long attack verification period, when the alert is released by analysis centers, the best time to stop the attack may have passed. On the other hand, (1) most of the past large scale attacks targeted known vulnerabilities, and (2) today numerous Internet systems have integrated detection tools, such as virus detection software and intrusion detection systems (IDS), the power of which could be harnessed to defend against large scale attacks. In this paper, we propose V-COPS – a vulnerabilitybased cooperative alert distribution system, by leveraging existing independent local attack detection systems. VCOPS is capable of promptly propagating genuine alerts with critical vulnerability information, based on which relevant stake...

• Type: Conference
• Year: 2006
• Where: ACSAC
• Authors: Shiping Chen, Dongyu Liu, Songqing Chen, Sushil Jajodia
• Keywords: ACSAC 2006, Analysis Centers, Large Scale, Large Scale Attacks, Security Privacy