An intrusion response decision-making model based on hierarchical task network planning

Expert Systems with Applications

Volumn 37, Issue 3, 2010, Pages 2465-2472

  Mu, Chengpo ^a   Li, Yingjiu ^b  

^a BEIJING INSTITUTE OF TECHNOLOGY   (China)

^b SINGAPORE MANAGEMENT UNIVERSITY   (Singapore)

Author keywords

Automated intrusion response system; Hierarchical task network planning; Intrusion detection; Intrusion response decision making

Indexed keywords

ALERT MANAGEMENT; AUTOMATED INTRUSION RESPONSE SYSTEM; DECISION MAKING MODELS; DECISION MAKING PROCESS; FALSE POSITIVE; HIERARCHICAL TASK NETWORK PLANNING; HIERARCHICAL TASK NETWORKS; INTRUSION RESPONSE; INTRUSION RESPONSE DECISION-MAKING; INTRUSION RESPONSE SYSTEM; NEGATIVE IMPACTS; RESPONSE MEASURES; RESPONSE TIME; SELF-ADAPTIVE; SUBTASKS;

INTRUSION DETECTION; RESPONSE TIME (COMPUTER SYSTEMS);

DECISION MAKING;

EID: 70449517238     PISSN: 09574174     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.eswa.2009.07.079     Document Type: Article

References (15)

1. Callan R. Artificial intelligence (2003), Palgrave Macmillan pp. 142-183
2. Carver, C. A. (2001). Adaptive-based intrusion response, PhD dissertation. College Station: Texas A&M University.
3. Chengpo M., Houkuan H., and Shengfeng T. A survey of intrusion-detection alert aggregation and correlation techniques. Journal of Computer Research and Development 43 1 (2006) 1-8
4. Fred, C. (1999). Simulating cyber attacks, defenses, and consequences, .
5. Lee W. Toward cost-sensitive modeling for intrusion detection and response. Journal of Computer Security 10 2 (2002) 5-22
6. Mu, C. P., Huang, H. K., & Tian, S. F. (2005). Intrusion Detection Alert Verification based on Multi-level Fuzzy Comprehensive Evaluation. In 2005 International conference on computational intelligence and security. LNAI 3801, Springer-Verlag, Berlin, Germany.
7. Mu, C. P., Huang, H. K., & Tian, S. F. (2005). Managing intrusion-detection alerts based on fuzzy comprehensive evaluation. In 10th International conference on fuzzy theory and technology (FTT2005). Salt Lake City, UT, USA.
8. Mu, C. P., Huang, H. K., & Tian, S. F. (2006). False positive alert, irrelevant alert and duplicate alert reduction based on a comprehensive approach. Journal of Dynamics of Continuous, Discrete and Impulsive System, Series B, Supplementary Issue.
9. Mu, C. P., Huang, H. K., & Tian, S. F. (2008). Online risk assessment of intrusion scenarios using D-S evidence theory. In Proceedings of 13th European symposium on research in computer securityα LNCS, Springer-Verlag, Berlin, Germany.
10. Porras, P. A., & Neumann, P.G. (1997). EMERALD: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of 20th national information systems security conference (pp. 353-365), Baltimore, MD, October 7-10 [Information Technology Lab, Gaithersburg USA 7].
11. Schnackenberg, D., Holliday, H., Smith, R., et al. (2001). Cooperative intrusion traceback and response architecture. In Proceedings of DARPA information survivability conference and exposition. Anaheim, CA.
12. Stakhanova, N., Basu, S., & Wong, J. (2006). A taxonomy of intrusion response systems. Technical Report 06-05, Ames, IA, USA: Department of Computer Science, Iowa State University.
13. Staniford S., Hoagland J.A., and McAlerney J.M. Practical automated detection of stealthy portscans. Journal of Computer Security 10 1-2 (2002) 105-136
14. Toth, T., & Kruegel, C. (2002). Evaluating the impact of automated intrusion response mechanisms. In Proceedings of 18th annual computer security application conference, Las Vegas, NV, USA, 2002.
15. White G.B., Fisch E.A., and Pooch U.W. Cooperating security managers: A peer-based intrusion detection system. IEEE Network 10 1 (1996) 20-23