Support for automated passive host-based intrusion response

摘要: Vulnerabilities continue to be discovered with high frequency. Threats that exploit them can recognized by intrusion detectors. Manual response, however, is becoming decreasingly tenable. We introduce a model for automatic real-time mitigation of the risk posed host. The derived from an extant analysis framework used information assurance community, applying it operating system paradigm. describe runtime support implementing scheme. SADDLE provides auditing architecture allows fidelity detection limited computational load and storage requirements. ARM modifies reference monitor dynamically constrain permissions control probability exposing threatened resources. RICE guarantees made about confidentiality, integrity availability data after penetration occurs. NOSCAM service pro-active gathering forensic evidence postmortem attack. These systems are combined through prototype response engine, RheoStat, whose utility demonstrated using set synthetic attacks.