Adaptive agent-based intrusion response

摘要: A new methodology has been developed for adaptive, automated intrusion response (IR) focusing on the role of software agents in providing that response. The majority systems (IRSs) react to attacks by generating reports or alarms. This introduces a window vulnerability between when an is detected and action taken defend against attack. reduced through agent-based system adaptively responds intrusions. Multiple IDSs monitor computer generate Interface maintain model each IDS based number false positives/negatives previously generated. It uses this attack confidence metric passes along with alarm Master Analysis agent. agent classifies whether incident continuation existing If it attack, creates develop plan handling analyzes until resolved generates course resolve incident. To action, involves Response Taxonomy classify Policy Specification limit legal, ethical, institutional, resource constraints. then invokes appropriate components Toolkit. employ adaptive decision-making success previous responses. As decisions are made, results displayed user interface. This research presents novel IR includes: adaptation intrusive behavior detection mechanism; responses; and, synergistic support multiple IDSs.