Sciweavers

JNSM
2008

Optimal IDS Sensor Placement and Alert Prioritization Using Attack Graphs

13 years 12 months ago
Optimal IDS Sensor Placement and Alert Prioritization Using Attack Graphs
We optimally place intrusion detection system (IDS) sensors and prioritize IDS alerts using attack graph analysis. We begin by predicting all possible ways of penetrating a network to reach critical assets. The set of all such paths through the network constitutes an attack graph, which we aggregate according to underlying network regularities, reducing the complexity of analysis. We then place IDS sensors to cover the attack graph, using the fewest number of sensors. This minimizes the cost of sensors, including effort of deploying, configuring, and maintaining them, while maintaining complete coverage of potential attack paths. The sensor-placement problem we pose is an instance of the NP-hard minimal set cover problem. We solve this problem through an efficient greedy algorithm, which works well in practice. Once sensors are deployed and alerts are raised, our predictive attack graph allows us to prioritize alerts based on attack graph distance to critical assets.
Steven Noel, Sushil Jajodia
Added 13 Dec 2010
Updated 13 Dec 2010
Type Journal
Year 2008
Where JNSM
Authors Steven Noel, Sushil Jajodia
Comments (0)