S-MAIDS: A Semantic Model for Automated Tuning, Correlation, and Response Selection in Intrusion Detection Systems

摘要: As cyber threats increasingly utilize automated and adaptive attacks to bypass or overwhelm static defenses, the role of intrusion detection response systems (IDRS) as an active defense layer is becoming more critical. To remain effective against current IDRS must be capable automating of, to, in their specific environment. Different operating characteristics, capabilities, actions all contribute make each environment unique, complicating this automation. In work we consider automation three areas: detector tuning, correlation, selection. We motivate present a novel, finely-grained model threats, detectors, responses called S-MAIDS: A Semantic Model Automated Intrusion Detection Systems. Based on concept "signal" (an observable indicator attack), show utility combining such with existing measure performance facilitate cross-system support our claims through several case-studies demonstrating application model, provide OWL ontology.