Study of Automated Intrusion Response

Huang Hao

2005-01-01

Abstract:This paper introduces the general architecture and characteristics of automated intrusion response system,discusses and evaluates the current main intrusion response techniques,and summaries four technologies including response-decision,cooperative response,self-adaption and traceback techniques as the future directions in this field.

What problem does this paper attempt to address?

Survey on Intrusion Detection Techniques

WU Qing-tao,SHAO Zhi-qing

DOI: https://doi.org/10.3969/j.issn.1001-3695.2005.12.004

2005-01-01

Abstract:Intrusion detection,as one of the most active and important network security technology,can compensate the shortcomings of traditional security protection measure.Through building dynamic security cycle,it can promote the protection capacity of system and reduce the security threats as great as possible. An overview of basic issues on intrusion detection is shown in this paper,which is involved with three main aspects of intrusion detection,including Intrusion Detection System(IDS) architecture,intrusion detection methods and IDS evaluation.Firstly,three kinds of IDS architectures are analyzed.Then,current intrusion detection models are given,and their merits or shortcomings are discussed in detail.Finally,some future promi￣sing directions are presented.
Intrusion Detection And Simulation For High-Speed Networks

Fei Yu,XiaoPing Dai,Yue Shen,Huang Huang,Miaoliang Zhu

DOI: https://doi.org/10.1109/ICSSSM.2005.1500110

2005-01-01

Abstract:The problem in network security presently is how to get real-time intrusion detection and alert. In the paper, we design Intrusion Detection System architecture and arithmetic again, meanwhile put forward an improved pattern matching arithmetic based on protocol analysis and theorization machine on Frete. New architecture can use network processor to collect and analyze data in network bottom, which enhance the speed and efficiency in Detection System.
Intrusion Response Systems: Past, Present and Future

Pushpinder Kaur Chouhan,Alfie Beard,Liming Chen

DOI: https://doi.org/10.48550/arXiv.2303.03070

2023-03-06

Abstract:The rapid expansion of the Internet of Things and the emergence of edge computing-based applications has led to a new wave of cyber-attacks, with intensity and complexity that has never been seen before. Historically most research has focused on Intrusion Detection Systems (IDS), however due to the volume and speed of this new generation of cyber-attacks it is no longer sufficient to solely detect attacks and leave the response to security analysts. Consequently, research into Intrusion Response Systems (IRS) is accelerating rapidly. As such, new intrusion response approaches, methods and systems have been investigated, prototyped, and deployed. This paper is intended to provide a comprehensive review of the state of the art of IRSs. Specifically, a taxonomy to characterize the lifecycle of IRSs ranging from response selection to response deployment and response implementation is presented. A 10-phase structure to organize the core technical constituents of IRSs is also presented. Following this, an extensive review and analysis of the literature on IRSs published during the past decade is provided, and further classifies them into corresponding phases based on the proposed taxonomy and phase structure. This study provides a new way of classifying IRS research, thus offering in-depth insights into the latest discoveries and findings. In addition, through critical analysis and comparison, expert views, guidance and best practices on intrusion response approaches, system development and standardization are presented, upon which future research challenges and directions are postulated.

Cryptography and Security
Multi-agent based hybrid Intrusion detection system

张宝军,潘雪增,王界兵,平玲娣

DOI: https://doi.org/10.3785/j.issn.1008-973X.2009.06.004

2009-01-01

Abstract:Real-time intrusion detection under current network environment exists the following problems: first, the scale of network is large, and a great deal of information needs to be processed, which requires large throughput to the intrusion detection system (IDS); second, the network environment is complex, and the data type is multiplex, accordantly, the intrusion detection system should has high accuracy. Aiming at these problems, a model of intrusion detection system was proposed. The model uses the distributed architecture based on multi-agent system and shows good expansibility, and can self-adjust according to the scale and bandwidth of network. The model uses technologies of anomaly intrusion detection and misuse intrusion detection together, and has low false alert rate and miss alert rate. Multi-attribute data abstraction is used in the model to grasp the feature of intrusion accurately and provide strong support for intrusion identification. The classifier is constructed with radial basis function (RBF) so as to have good extension to unknown intrusions, and can do effective judgment to unknown intrusions. Experimental results show that the system has large throughput and high accuracy, thus it is suitable for current network and has good practicability.
NAIR: A Novel Automated Intrusion Response System Based on Decision Making Approach

Xin Zan,Feng Gao,Jiuqiang Han,Xiaoyong Liu

DOI: https://doi.org/10.1109/icinfa.2010.5512396

2010-01-01

Abstract:In recent years, automated intrusion response has become a promising research problem in network security. Several approaches have been proposed to perform an effective automated response policy. However, these approaches have some limitations, i.e., heavily depending on attack alerts and not taking in account uncertainty of system runtime state. In this paper, we present a comprehensive sequential decision-making based automated intrusion response approach. We utilize different decision approaches and models to respectively represent and reason about attack activities and system runtime state in view of their different dynamic nature. We perform some experiments to validate proposed approach and the results show that our approach has good performance in response accuracy to different attack scenarios and robustness against false alerts.
REACT: Autonomous Intrusion Response System for Intelligent Vehicles

Mohammad Hamad,Andreas Finkenzeller,Michael Kühr,Andrew Roberts,Olaf Maennel,Vassilis Prevelakis,Sebastian Steinhorst

2024-01-17

Abstract:Autonomous and connected vehicles are rapidly evolving, integrating numerous technologies and software. This progress, however, has made them appealing targets for cybersecurity attacks. As the risk of cyber threats escalates with this advancement, the focus is shifting from solely preventing these attacks to also mitigating their impact. Current solutions rely on vehicle security operation centers, where attack information is analyzed before deciding on a response strategy. However, this process can be time-consuming and faces scalability challenges, along with other issues stemming from vehicle connectivity. This paper proposes a dynamic intrusion response system integrated within the vehicle. This system enables the vehicle to respond to a variety of incidents almost instantly, thereby reducing the need for interaction with the vehicle security operation center. The system offers a comprehensive list of potential responses, a methodology for response evaluation, and various response selection methods. The proposed solution was implemented on an embedded platform. Two distinct cyberattack use cases served as the basis for evaluating the system. The evaluation highlights the system's adaptability, its ability to respond swiftly, its minimal memory footprint, and its capacity for dynamic system parameter adjustments. The proposed solution underscores the necessity and feasibility of incorporating dynamic response mechanisms in smart vehicles. This is a crucial factor in ensuring the safety and resilience of future smart mobility.

Cryptography and Security
A Systematic Mapping Study on Intrusion Response Systems

Adel Rezapour,Mohammad GhasemiGol,Daniel Takabi

DOI: https://doi.org/10.1109/access.2024.3381998

IF: 3.9

2024-04-05

IEEE Access

Abstract:With the increasing frequency and sophistication of network attacks, network administrators are facing tremendous challenges in making fast and optimum decisions during critical situations. The ability to effectively respond to intrusions requires solving a multi-objective decision-making problem. While several research studies have been conducted to address this issue, the development of a reliable and automated Intrusion Response System (IRS) remains unattainable. This paper provides a Systematic Mapping Study (SMS) for IRS, aiming to investigate the existing studies, their limitations, and future directions in this field. A novel semi-automated research methodology is developed to identify and summarize related works. The innovative approach not only streamlines the process of literature review in the IRS field but also has the potential to be adapted and implemented across a variety of research fields. As a result of this methodology, 287 papers related to the IRS were identified from a pool of 6143 studies extracted by the developed web robot based on initial keywords. This highlights its effectiveness in navigating and extracting valuable insights from the extensive body of literature. Furthermore, this research methodology allows the identification of prominent researchers, journals, conferences, and high-quality papers in the field of study.

computer science, information systems,telecommunications,engineering, electrical & electronic
AI Enhanced Automatic Response System for Resisting Network Threats.

Song Xia,Meikang Qiu,Meiqin Liu,Ming Zhong,Hui Zhao

DOI: https://doi.org/10.1007/978-3-030-34139-8_22

2019-01-01

Abstract:Network threats are malicious attacks that endanger network security. With terabits of information stored in the network and much of this information being confidential, cyber security turns to be very important. Most network protection mechanisms are based on firewall and Intrusion Detection System ( IDS ). However, with the diversification of cyber-attacks, traditional defense mechanisms cannot fully guarantee the security of the network. In this paper, we propose an automatic network threat response system based on machine learning and deep learning. It comprises three sub-modules: threat detection module, threat identification module and threat mitigation module. The experimental results show that the proposed system can handle 22 types of network threats in the KDD99 dataset and the rate of successful response is over 97%, which is much better than the traditional ways.
Intrusion detection techniques and approaches

Theuns Verwoerd,Ray Hunt

DOI: https://doi.org/10.1016/s0140-3664(02)00037-3

IF: 5.047

2002-09-01

Computer Communications

Abstract:Recent security incidents and analysis have demonstrated that manual response to such attacks is no longer feasible. Intrusion detection systems (IDS) offer techniques for modelling and recognising normal and abusive system behaviour. Such methodologies include statistical models, immune system approaches, protocol verification, file and taint checking, neural networks, whitelisting, expression matching, state transition analysis, dedicated languages, genetic algorithms and burglar alarms. This paper describes these techniques including an IDS architectural outline and an analysis of IDS probe techniques finishing with a summary of associated technologies.

computer science, information systems,telecommunications,engineering, electrical & electronic
Research of Intrusion Detection Based on Intelligence and Cooperation Technology

ZHANG LILI,CAO TIANJIE

DOI: https://doi.org/10.3969/j.issn.1008-0570.2008.06.025

2008-01-01

Abstract:To be dead against the high false alarm rate,leakage rate,numerous detection algorithm,the passive response pattern and other such problem,a collaboration-based intelligent intrusion detection system was proposed. This technique is fully integrated with the advantages of some intrusion detection algorithm to make those scheme achieve optimal detection performance. Further more,this system could joint security and safety equipment and technology in response,change from passive to active. It forms a cooperative intrusion detection system of both detection and response.
The Evolving Intrusion Detection System

LIN Guo-Yuan,HUANG Hao,ZHANG Yong-Ping

2008-01-01

Computer Science

Abstract:Intrusion detection system is an important device of information security.In this paper,firstly,the current research on intrusion detection system is summarized in detail,and new characters are pointed out includes the adoption of intelligent algorithms,data fusion technology,alerts correlation algorithms,the variety of data sources and the collaboration with other security devices.Secondly,the recently work of testing and standardization about intrusion detection system is expounded.Finally,some directions for future research are addressed.
Applying Mobile Agent to Intrusion Response for Ad Hoc Networks.

P Yi,YP Zhong,SY Zhang

DOI: https://doi.org/10.1007/11428848_77

2005-01-01

Abstract:Mobile ad hoc networking offers convenient infrastructureless communication over the shared wireless channel. However, the nature of ad hoc networks makes them vulnerable to security attacks. Existing security technologies such as intrusion prevention and intrusion detection are passive in response to intrusions in that their countermeasures are only to protect the networks and there is no automated, network-wide counteraction against detected intrusions. While they all play an important role in counteracting intrusion, they do not, however, effectively address the root cause of the problem – intruders. In this paper, we propose the architecture of automated intrusion response. When an intruder is found in our architecture, the block agents will get to the neighbor nodes of the intruder and formed the mobile firewall to isolate the intruder.
RESEARCH AND IMPLEMENTATION OF INTRUSION DETECTION BASED ON HIERARCHICAL STRUCTURE

Yong ZHANG,De-yun ZHANG,Sheng-lei LI,Xu-xian IANG

DOI: https://doi.org/10.3969/j.issn.1000-1220.2001.01.011

2001-01-01

Abstract:In this paper the traditional intrusion detection technology is analyzed . analys and presents a intrusion detection framework based on hierarchical structure . The technologies such as agent、expert system、computer immunology、distributed system are integrated to construct a strong intrusion detection framework.
Automatic network intrusion detection: Current techniques and open issues

Carlos A. Catania,Carlos García Garino

DOI: https://doi.org/10.1016/j.compeleceng.2012.05.013

2012-09-01

Abstract:Automatic network intrusion detection has been an important research topic for the last 20years. In that time, approaches based on signatures describing intrusive behavior have become the de-facto industry standard. Alternatively, other novel techniques have been used for improving automation of the intrusion detection process. In this regard, statistical methods, machine learning and data mining techniques have been proposed arguing higher automation capabilities than signature-based approaches. However, the majority of these novel techniques have never been deployed on real-life scenarios. The fact is that signature-based still is the most widely used strategy for automatic intrusion detection. In the present article we survey the most relevant works in the field of automatic network intrusion detection. In contrast to previous surveys, our analysis considers several features required for truly deploying each one of the reviewed approaches. This wider perspective can help us to identify the possible causes behind the lack of acceptance of novel techniques by network security experts.

engineering, electrical & electronic,computer science, interdisciplinary applications, hardware & architecture
Research on Dynamic Adaptive Intrusion Detection Model

ZHANG Ran,HE Jing-sha

2005-01-01

Abstract:Based on the analysis of the limitation of traditional intrusion detection systems, the concept of dynamic adaptive IDS is proposed, and a model of dynamic adaptive intrusion detection and response is estab-lished. By dynamic association among its elements and adaptive policies, this model provides dynamic adaptability to the changing environment and attacks with its dynamically configurable architecture, functions, and management. In addition, the concept of coordination domain is proposed in order to facilitate the management of coordinative detection.
Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems

Moses Garuba,Chunmei Liu,Duane Fraites

DOI: https://doi.org/10.1109/itng.2008.231

2008-04-01

Abstract:Organizations require security systems that are flexible and adaptable in order to combat increasing threats from software vulnerabilities, virus attacks and other malicious code, in addition to internal attacks. Network intrusion detection systems, which are part of the layered defense scheme, must be able to meet these organizational objectives in order to be effective. Although signature based network intrusion detection systems meet several organizational security objectives, heuristic based network intrusion detection systems are able to fully meet the objectives of the organization. Through a comparative theoretical study, this paper analyzes several organizational security objectives in order to determine the network intrusion detection system that effectively meets these objectives. Through conclusive analysis of the study, heuristic based systems are better served to meet the organizational objectives than signature based systems. The analysis was based on which system provided definitive security objectives and offered the flexibility, adaptability, and reduced vulnerability that an organization requires.
Cost-based Intelligent Intrusion Detection and Response: Design and Implement

SJ Zhou,ZG Qin,XC Luo,XF Zhang,F Zhang,JD Liu

DOI: https://doi.org/10.1109/pdcat.2003.1236280

2003-01-01

Abstract:Flexible intrusion detection and response system (ID&R) needs to maximize security while minimizing cost and making response automatically. (CID)-D-2&R, the Cost-based Intelligent Intrusion Detection and Response System, is proposed in the paper, which is originally developed as a facility to deal with network-based attacks and to make effective response automatically and intelligently. The networking environment deployed with the (CID)-D-2&R consists of two major parts: Guard, which runs on the specific Guarded Host (GH), and Spy, which runs in Guarded Network (GN). The components of the (CID)-D-2&R are introduced, which include intrusion detection, attack classification, damage analysis, attack path rebuilding, resources automatically safeguarding, calamity recovery, and security Officer. The several kinds of data flow in (CID)-D-2&R are discussed, too. While (CID)-D-2&R is only a prototype, some experimental results are also presented.
Research on Agent-based Intrusion Detection Technique

WANG Jun,WANG Chong-Jun,XIE Jun-Yuan,CHEN Shi-Fu

DOI: https://doi.org/10.3969/j.issn.1002-137x.2006.12.017

2006-01-01

Computer Science

Abstract:Intrusion detection is a proactive network security protection mechanism, which has become a research focus in the field of the network security. Since the Agent-based intrusion detection systems have the features of the distributed coordination processing and intelligence, many researchers attach great importance to it and it has become a research trend for the next generation intrusion detection systems. In this paper, we first introduce the history of the intrusion detection systems (IDS)and its classifications. And then some recent research development that related to the key aspects of static Agent-based intrusion detection systems and mobile Agent-based intrusion detections systems are deeply explored. And their development treads are also given. In the end, we present some possible research directions and challenges for Agent-based intrusion detection systems.
Towards an Effective Intrusion Response Engine Combined with Intrusion Detection in Ad Hoc Networks

Aikaterini Mitrokotsa,Nikos Komninos,Christos Douligeris

DOI: https://doi.org/10.48550/arXiv.0807.2053

2008-07-13

Cryptography and Security

Abstract:In this paper, we present an effective intrusion response engine combined with intrusion detection in ad hoc networks. The intrusion response engine is composed of a secure communication module, a local and a global response module. Its function is based on an innovative tree-based key agreement protocol while the intrusion detection engine is based on a class of neural networks called eSOM. The proposed intrusion response model and the tree-based protocol, it is based on, are analyzed concerning key secrecy while the intrusion detection engine is evaluated for MANET under different traffic conditions and mobility patterns. The results show a high detection rate for packet dropping attacks.
Several Approaches Used in Intrusion Detection Based on Artificial Intelligence

ZHOU Quan,WANG Chong-jun,WANG Jun,ZHOU Xin-min,CHEN Shi-fu

DOI: https://doi.org/10.3969/j.issn.1001-3695.2007.05.045

2007-01-01

Abstract:The ability to detect intruders in computer systems increases in importance as computers were increasingly integra-ted into the systems that rely on for the correct functioning of society.A history of research in intrusion detection and several approaches based on AI technology in IDS especially some machine learning technology,and then agent-based intrusion detection systems were introduced.In the end,some possible research directions and challenges was presented in this field.

Study of Automated Intrusion Response

Survey on Intrusion Detection Techniques

Intrusion Detection And Simulation For High-Speed Networks

Intrusion Response Systems: Past, Present and Future

Multi-agent based hybrid Intrusion detection system

NAIR: A Novel Automated Intrusion Response System Based on Decision Making Approach

REACT: Autonomous Intrusion Response System for Intelligent Vehicles

A Systematic Mapping Study on Intrusion Response Systems

AI Enhanced Automatic Response System for Resisting Network Threats.

Intrusion detection techniques and approaches

Research of Intrusion Detection Based on Intelligence and Cooperation Technology

The Evolving Intrusion Detection System

Applying Mobile Agent to Intrusion Response for Ad Hoc Networks.

RESEARCH AND IMPLEMENTATION OF INTRUSION DETECTION BASED ON HIERARCHICAL STRUCTURE

Automatic network intrusion detection: Current techniques and open issues

Research on Dynamic Adaptive Intrusion Detection Model

Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems

Cost-based Intelligent Intrusion Detection and Response: Design and Implement

Research on Agent-based Intrusion Detection Technique

Towards an Effective Intrusion Response Engine Combined with Intrusion Detection in Ad Hoc Networks

Several Approaches Used in Intrusion Detection Based on Artificial Intelligence