آمار
| تعداد نشریات | 36 |
| تعداد شماره‌ها | 1,192 |
| تعداد مقالات | 8,579 |
| تعداد مشاهده مقاله | 6,989,645 |
| تعداد دریافت فایل اصل مقاله | 4,033,169 |
چارچوبی آیندهنگر برای سامانههای پاسخ به نفوذ در شبکه‌های رایانه‌ای | ||
| پدافند الکترونیکی و سایبری | ||
| مقاله 2، دوره 6، شماره 3 - شماره پیاپی 23، آذر 1397، صفحه 13-34 اصل مقاله (1.6 M) | ||
| نوع مقاله: مقاله پژوهشی | ||
| نویسنده | ||
| محمد قاسمی گل* | ||
| دانشگاه بیرجند | ||
| تاریخ دریافت: 27 شهریور 1396، تاریخ بازنگری: 19 اردیبهشت 1397، تاریخ پذیرش: 06 خرداد 1397 | ||
| چکیده | ||
| امروزه افزایش هشدارهای صادرشده توسط سامانههای محافظ امنیت منجر به بروز چالش جدیدی برای مدیران امنیت شبکه شده است. اصولاً مدیریت و پاسخگویی به این حجم زیاد هشدارها کار دشواری است. از اینرو، مدیریت هشدار و سامانه پاسخ را میتوان به عنوان اساسیترین بخشهای سامانههای محافظ امنیت از جمله سامانههای تشخیص نفوذ در نظر گرفت. در سالهای اخیر، بیشتر تحقیقات صورتگرفته به طور مجزا به بحث مدیریت هشدار و سامانه پاسخ پرداختهاند، درحالیکه این دو بخش لازم و ملزوم یکدیگر هستند و عملکردشان بر روی یکدیگر تأثیرگذار است. بخش مدیریت هشدارها بایستی به گونهای طراحی شود که اطلاعات لازم در مورد حملات رخ داده را متناسب با نوع سامانه پاسخ در اختیار آن قرار دهد. این اطلاعات به همراه اطلاعات مستخرج از منابع شبکه، وضعیت فعلی شبکه را برای سامانه پاسخ ترسیم میکنند. با اینحال، چنانچه تصمیمات اتخاذشده در سامانه پاسخ تنها براساس اطلاعات وضعیت فعلی شبکه باشد، مجموع هزینههای شبکه در طول زمان افزایش مییابد. از اینرو، میتوان با کمک مفهوم آیندهنگری از کلیه اطلاعات موجود و قابل دسترس برای شناسایی وضعیت فعلی شبکه و کلیه وضعیتهای پیش رو استفاده نمود و فرآیند تصمیمگیری در سامانه پاسخ را با این نگاه بهبود بخشید. در این مقاله هدف ما ارائه یک رویکرد آیندهنگر جهت یافتن پاسخهای بهینه برای مقابله با حملات رخ داده و حملات محتمل آینده است. برای این منظور معماری پیشنهادی شامل دو بخش کلی 1) مدلسازی هشدارها و حملات و 2) مدلسازی پاسخ میباشد. در بخش نخست با تحلیل هشدارهای مستخرج از سامانههای تشخیص نفوذ سعی کردهایم ورودی مناسب برای سامانه پاسخ خودکار فراهم شود. همچنین به منظور پیشبینی حملات آینده روشهایی جهت تحلیل حملات به صورت پویا ارائه شده است تا از این طریق، انتخاب پاسخ مناسب با دید آیندهنگر انجام گیرد. در بخش دوم نیز ابتدا با ارائه یک مدل بازنمایی مناسب به تحلیل مجموعه پاسخها پرداختهایم. سپس با بررسی شرایط فعلی و آتی شبکه، هزینهها و سودمندیهای هر پاسخ به طور دقیق محاسبه شده است. درنهایت، مدلهایی جهت انتخاب پاسخهای مناسب با کمک روشهای تصمیمسازی ارائه شده است. نتایج حاصل از شبیهسازی با سناریوهای مختلف نشان میدهد با کمک آیندهنگری در سامانه پاسخ میتوان هزینههای ناشی از وقوع حمله به شبکه و اعمال پاسخ را تا حد زیادی کاهش داد و شبکه را به سوی وضعیتهایی با هزینه کم هدایت نمود. | ||
| کلیدواژه‌ها | ||
| سامانه پاسخ به نفوذ؛ آیندهنگری؛ مدیریت هشدار؛ گراف حمله آگاه به عدم قطعیت؛ گراف وابستگی‌های شبکه؛ فرآیند تصمیمسازی مارکوف | ||
| عنوان مقاله [English] | ||
| A Foresight Framework for Intrusion Response Systems in Computer Networks | ||
| نویسندگان [English] | ||
| Mohammad Qasemi Gol | ||
| چکیده [English] | ||
| Today, the number of alerts issued by network security systems has increased significantly and network administrators encounter new problems in handling the issued alerts and responding to them. As managing and responding to such a large number of alerts is difficult, alert management and intrusion response system (IRS) are the main part of the security protection systems including intrusion detection systems. The main task of alert management is to reveal the attack details to IRS. Subsequently, the appropriate responses are applied to reduce the attack damage and recover the compromised computer networks back to their normal operational mode. In the literature, researchers have investigated alert management techniques and IRS solutions separately, despite the fact that alert management is one of the basic requirements of response process and its outcome directly affects the IRS performance. Alert management design should provide the necessary information about the attacks to the response system according to its type and requirements. This information along with information from network resources present the current state of the network to IRS. However, if decisions taken by the response system is only based on the current network status, the total cost of the network will increase over the time. Therefore with a futuristic concept and considering the present available information and all possible coming states, decision making process in the response system can be improved. In this paper, using a futuristic approach we seek to propose optimal solutions for confronting already-occurred and future-probable attacks. To achieve this goal, the proposed framework contains two subsystems: attacks and alerts modeling, and response modeling. In the first subsystem, we analyze the IDS alerts to find the similarity and causality relationships. We also present a comprehensive approach for network attack forecasting to obtain some useful predictions about the future states of the network. In the second subsystem, the response analyzer presents a multilevel response model to categorize intrusion responses. It also provides a foresight model to estimate the response cost by considering IDS alerts, network dependencies, attack damage, response impact, and the probability of potential attacks. Finally, models are proposed to make the best decision based on available information about the present and all possible coming states. Simulation results for different scenarios show that the response system, with a prospective vision, steers the network toward desired states with reduced cost of attack and response. | ||
| کلیدواژه‌ها [English] | ||
| Intrusion Response System, Foresight, Alert Management, Uncertainty-aware Attack Graph, Network Dependency Graph, Markov Decision Process | ||
| مراجع | ||
|
[1] N. Stakhanova, S. Basu, and J. Wong, “A Taxonomy of Intrusion Response Systems,” International Journal of Information and Computer Security, vol. 1, no. 1/2, pp. 169-184, 2007. [2] A. A. Ghorbani, W. Lu, and M. Tavallaee, “Network Intrusion Detection and Prevention Concepts and Techniques,” Springer US, 2009. [3] M. M. Siraj and S. Z. M. Hashim, “Modeling Intrusion Alerts using IDMEF Data Model,” University Technology of Malaysia, 2008. [4] H. T. Elshousha and I. M. Osman, “Alert correlation in collaborative intelligent intrusion detection systems—A survey,” Appl. Soft Comput., vol. 11, pp. 4349–4365, 2011. [5] K. A. Alsubhi, “A Fuzzy-logic based Alert Prioritization Engine for IDSs: Architecture and Configuration,” University of Waterloo, 2008. [6] K. Alsubhi, I. Aib, and R. Boutaba, “FuzMet: a fuzzy‐logic based alert prioritization engine for intrusion detection systems,” Int J Netw Manag, vol. 22, no. 4, pp. 263-284, 2012. [7] H. Q. Wang, G. F. Wang, Y. Lan et al., “A new automatic intrusion response taxonomy and its application,” in The 8th Asia-Pacific Web Conference and Workshops (APWeb 2006), Harbin, People R China, pp. 999-1003, 2006. [8] A. Avizienis, J. C. Laprie, B. Randell et al., “Basic concepts and taxonomy of dependable and secure computing,” IEEE Trans Dependable Secure Comput, vol. 1, no. 1, pp. 11-33, 2004. [9] G. Idowu, O. Enikuomehin, and S. Olasanoye, “Intrusion Response Systems: An Overview,” Asian Journal of Information Technology, vol. 10, no. 5, pp. 192-200, 2011. [10] S. A. Zonouz, “Game-theoretic intrusion response and recovery,” University of Illinois at Urbana-Champaign, 2011. [11] N. B. A. Jumaat, “Incident prioritisation for intrusion response systems,” Plymouth University, 2012. [12] N. Stakhanova, S. Basu, and JohnnyWong, “A Cost-Sensitive Model for Preemptive Intrusion Response Systems,” in 21st International Conference on Advanced Networking and Applications, Niagara Falls, ON, Canada, pp. 428-435, 2007. [13] B. Foo, Y.-S. Wu, Y.-C. Mao et al., “ADEPTS: Adaptive intrusion response using attack graphs in an e-commerce environment,” in The 2005 International Conference on Dependable Systems and Networks, Yokohama, Japan, pp. 508–517, 2005. [14] M. E. Locasto, K. Wang, A. D. Keromytis et al., “FLIPS: Hybrid adaptive intrustion prevention,” in The 8th international conference on Recent Advances in Intrusion Detection (RAID), Seattle, WA, USA, pp. 82-101, 2005. [15] K. Haslum, A. Abraham, and S. Knapskog, “DIPS : A framework for distributed intrusion prediction and prevention using hidden markov models and online fuzzy risk assessment,” in the 3rd International Symposium on Information Assurance and Security, Manchester, United Kingdom, pp. 183-188, 2007. [16] Z. Zhang, P.-H. Ho, and L. He, “Measuring IDS-estimated attack impacts for rational incident response: A decision theoretic approach,” Comput. Secur., vol. 28, pp. 605-614, 2009. [17] W. Kanoun, N. Cuppens-Boulahia, F. Cuppens, et al., “Risk-Aware Framework for Activating and Deactivating Policy-Based Response,” in The Fourth International Conference on Network and System Security, Melbourne, VIC, pp. 207-215, 2010. [18] N. Kheir, N. Cuppens-Boulahia, F. Cuppens, et al., “A service dependency model for cost sensitive intrusion response,” in The 15th European Conference on Research in Computer Security, Athens, Greece, pp. 626-642, 2010. [19] A. Shameli-Sendi, J. Desfossez, M. Dagenais, et al., “A Retroactive-Burst Framework for Automated Intrusion Response System,” Journal of Computer Networks and Communications, 2013. [20] A. Shameli-Sendi, “System health monitoring and proactive response activation,” Université de Montréal, Canada, 2013. [21] C. Mu and Y. Li, “An intrusion response decision-making model based on hierarchical task network planning,” Expert. Syst. Appl., vol. 37, no. 3, pp. 2465-2472, 2010. [22] H. W. Njogu, L. Jiawei, J. N. Kiere, et al., “A comprehensive vulnerability based alert management approach for large networks,” Future Generat Comput. Syst., vol. 29, pp. 27-45, 2013. [23] S. Parsa, H. Saifi, and M.-H. Alaeian, “Providing a New Approach to Discovering Malware Behavioral Patterns Based on the Dependency Graph Between System Calls,” Journal Of Electronical & Cyber Defence, vol. 4, no. 3, 2016 (In Persian). [24] X. Ou, S. Govindavajhala, and A. W. Appel, “MulVAL: A Logic-based Network Security Analyzer,” in USENIX Security, 2005. [25] K. Kaynar, “A taxonomy for attack graph generation and usage in network security,” Journal of Information Security and Applications, vol. 29, pp. 27-56, 2016. [26] S. Wu, Y. Zhang, and W. Cao, “Network security assessment using a semantic reasoning and graph based approach,” Comput. Electr. Eng., 2017. [27] H. Li, Y. Wang, and Y. Cao, “Searching Forward Complete Attack Graph Generation Algorithm Based on Hypergraph Partitioning,” Procedia Computer Science, vol. 107, pp. 27-38, 2017. [28] M. Keramati, “Using Attack Graph for Improving Intrusion Response Systems in Computer Networks,” Iran University of Science and Technology, 2011. (In Persian). [29] B. Gruschke, “Integrated event management: Event correlation using dependency graphs,” in Proceedings of the 9th IFIP/IEEE International Workshop on Distributed Systems: Operations & Management (DSOM 98), pp. 130-141, 1998. [30] Y. Zhai, P. Ning, and J. Xu, “Integrating IDS Alert Correlation and OS-Level Dependency Tracking,” in The 4th IEEE international conference on Intelligence and Security Informatics, pp. 272-284, 2006. [31] T. Toth, and C. Kruegel, “Evaluating the impact of automated intrusion response mechanisms,” in The 18th Annual Computer Security Applications Conference, Las Vegas, Nevada, pp. 301-310, 2002. [32] I. Balepin, S. Maltsev, J. Rowe, et al., “Using specification-based intrusion detection for automated response,” in The 6th International Symposium on Recent Advances in Intrusion Detection (RAID), Pittsburgh, PA, USA, 2003. [33] A. Shameli-Sendi, and M. Dagenais, “ORCEF: Online response cost evaluation framework for intrusion response system,” J. Netw. Comput. Appl., vol. 55, pp. 89-107, 2015. [34] M. GhasemiGol and A. Ghaemi‐Bafghi, “E‐correlator: an entropy‐based alert correlation system,” Secur. Comm. Network, vol. 8, no. 5, pp. 822–836, 2015. [35] M. Ester, H.-P. Kriegel, J. Sander, et al., “A Density-Based Algorithm for Discovering Clusters in Large Spatial Databases with Noise,” in 2nd International Conference on Knowledge Discovery and Data Mining (KDD-96), 1996. [36] K. Julisch, “Clustering intrusion detection alarms to support root cause analysis,” ACM Trans Inform Syst Secur, vol. 6, no. 4, pp. 443-471, 2003. [37] M. GhasemiGol, A. Ghaemi-Bafghi, and H. Takabi, “A comprehensive approach for network attack forecasting,” Comput. Secur., vol. 58, pp. 83-105, 2016. [38] M. GhasemiGol, H. Takabi, and A. Ghaemi-Bafghi, “A foresight model for intrusion response management,” Comput. Secur., vol. 62, pp. 73-94, 2016. [39] T. L. Saaty, “Decision making with the analytic hierarchy process,” Int J Serv Sci, vol. 1, no. 1, pp. 83-98, 2008.
| ||
|
آمار تعداد مشاهده مقاله: 662 تعداد دریافت فایل اصل مقاله: 290 |
||