Abstract:Abstraction is an important issue in intrusion detection, since it not only hides the difference between heterogeneous systems, but also allows generic intrusion-detection models. However, abstraction is an error-prone process and is not well supported in current intrusion-detection systems (IDSs). This article presents a hierarchical model to support attack specification and event abstraction in distributed intrusion detection. The model involves three concepts: system view , signature , and view definition . A system view provides an abstract interface of a particular type of information; defined on the instances of system views, a signature specifies certain distributed attacks or events to be monitored; a view definition is then used to derive information from the matches of a signature and presents it through a system view. With the three elements, the model provides a hierarchical framework for maintaining signatures, system views, as well as event abstraction. As a benefit, the model allows generic signatures that can accommodate unknown variants of known attacks. Moreover, abstraction represented by a system view can be updated without changing either its specification or the signatures specified on its basis. This article then presents a decentralized method for autonomous but cooperative component systems to detect distributed attacks specified by signatures. Specifically, a signature is decomposed into finer units, called detection tasks , each of which represents the activity to be monitored on a component system. The component systems (involved in a signature) then perform the detection tasks cooperatively according to the "dependency" relationships among these tasks. An experimental system called CARDS has been implemented to test the feasibility of the proposed approach.

A Hierarchical Model for Distributed Attacks

A Reference Model And System Architecture For Database Firewall

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Attack Detection for Distributed Photovoltaic Generation Systems Leveraging Cyber and Power Side Channel Data

Hidden Markov Model-Based Attack Detection for Networked Control Systems Subject to Random Packet Dropouts

Modeling and Defending Advanced Metering Infrastructure Subjected to Distributed Denial-of-Service Attacks

Abstraction-based intrusion detection in distributed environments.

Modeling impact of attacks, recovery, and attackability conditions for situational awareness

A Stochastic Modeling of Coordinated Internal and External Attacks

Detection of Covert Cyber-Attacks in Interconnected Systems: A Distributed Model-Based Approach

An Network Attack Modeling Method Based on MLL-AT

Attack–Defense Game Model with Multi-Type Attackers Considering Information Dilemma

Distributed Adaptive Consensus Control for Nonlinear Systems with Active-Defense Mechanism Against Denial-of-Service Attacks

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Mobile Agent Based Distributed Intrusion Detection System Model Protecting from Attack

Service Reliability and Availability Analysis of Distributed Software Systems Considering Malware Attack

Analysis and Research of Attack Model

A Seesaw Model Attack Algorithm for Distributed Learning

A Framework of Hierarchical Attacks to Network Controllability

A Model of APT Attack Defense Based on Cyber Threat Detection