Evaluating the Impact of Automated Intrusion Response Mechanisms

12 years 29 days ago
Evaluating the Impact of Automated Intrusion Response Mechanisms
Intrusion detection systems (IDSs) have reached a high level of sophistication and are able to detect intrusions with a variety of methods. Unfortunately, system administrators neither can keep up with the pace that an IDS is delivering alerts, nor can they react upon these within adequate time limits. Automatic response systems have to take over that task. In case of an identified intrusion, these components have to initiate appropriate actions to counter emerging threats. Most current intrusion response systems (IRSs) utilize static mappings to determine adequate response actions in reaction to detected intrusions. The problem with this approach is its inherent inflexibility. Countermeasures (such as changes of firewall rules) often do not only defend against the detected attack but may also have negative effects on legitimate users of the network and its services. To prevent a situation where a response action causes more damage that the actual attack, a mechanism is needed that...
Thomas Toth, Christopher Krügel
Added 14 Jul 2010
Updated 14 Jul 2010
Type Conference
Year 2002
Authors Thomas Toth, Christopher Krügel
Comments (0)