A Network-Based Response Framework and Implementation

摘要: As the number of network-based attacks increase, and system administrators become overwhelmed with Intrusion Detection System (IDS) alerts, systems that respond to these are rapidly becoming a key area research. Current response solutions either localized individual hosts, or focus on refined set possible resources, which emulate many features low level IDS sensors. In this paper, we describe modular framework can incorporate existing sensors. This combines components by uniting models represent: events affect state system, detection capabilities sensors, agents, conditions represent policy. Linking provides foundation for generating responses best satisfy policy, given perceived sensors agents.