Risk balance defense approach against intrusions for network server

Publication Type

Journal Article

Publication Date

2013

Abstract

The paper presents a new defense approach based on risk balance to protect network servers from intrusion activities. We construct and implement a risk balance system, which consists of three modules, including a comprehensive alert processing module, an online risk assessment module, and a risk balance response decision-making module. The alert processing module improves the information quality of intrusion detection system (IDS) raw alerts by reducing false alerts rate, forming alert threads, and computing general parameters from the alert threads. The risk assessment module provides accurate evaluation of risks accordingly to alert threads. Based on the risk assessment, the response decision-making module is able to make right response decisions and perform very well in terms of noise immunization. Having advantages over conventional intrusion response systems, the risk balancer protects network servers not by directly blocking intrusion activities but by redirecting related network traffics and changing service platform. In this way, the system configurations that favor attackers are changed, and attacks are stopped with little impact on services to users. Therefore, the proposed risk balance approach is a good solution to not only the trade-off between the effectiveness and the negative effects of responses but also the false response problems caused by both IDS false-positive alerts and duplicated alerts.

Keywords

Risk balance, Intrusion response, Risk assessment, Alert processing, Intrusion detection

Discipline

Information Security

Research Areas

Information Security and Trust

Publication

International Journal of Information Security

Volume

13

Issue

3

First Page

255

Last Page

269

ISSN

1615-5262

Identifier

10.1007/s10207-013-0214-9

Publisher

Springer Verlag

Additional URL

http://dx.doi.org/10.1007/s10207-013-0214-9

Link to Full Text

Share

COinS