ARITO: Cyber-attack response system using accurate risk impact tolerance

摘要: We propose a novel approach for automated intrusion response systems to assess the value of loss that could be suffered by compromised resource. A risk assessment component measures impact and is tightly integrated with our system component. When total exceeds certain threshold, selection mechanism applies one or more responses. multi-level proposed gauge damage (attack progress) relative impact. This model proposes feedback mechanism, which goodness helps indicate new level following application response(s). Not only does constitutes online activation deactivation based on impact, it also addresses factors inherent in assessing calculating effectiveness are complex terms detail. have designed sophisticated multi-step attack penetrate Web servers, as well acquire root privilege. Our simulation results illustrate efficiency confirm feasibility real time. At end paper, we discuss various ways an attacker might succeed completely bypassing system.