In this talk, we focus on concurrent intrusion detection and assessment. Our intrusion assessment scheme is based on the hypothesis that if one could reasonably encapsulate the intent of the user of a computing system, then it is possible to assess intrusions by monitoring the activities on-line. To achieve this goal, a set of assertable conclusions, or simply assertions, is first generated by a strategic, dynamic and proactive query of system users. These assertions are used as a basis to verify the satisfiability of computing premises assisted by on-line monitoring of conclusions resulting from actual user actions. In addition, sequences of assertions are derived by analyzing the dynamically generated user data in real-time so as to enhance the intrusion assessment capabilities and lower the latency.
Quick recovery is only possible if the assessment scheme has low latency and it occurs in real-time.