ORCEF: Online response cost evaluation framework for intrusion response system
Response cost evaluation is a major part of the Intrusion Response System (IRS). Although many automated IRSs have been proposed, most of them use statically evaluated responses, avoiding the need for dynamic evaluation of response cost. However, by designing a dynamic evaluation for the responses we can alleviate the drawbacks of the static model. Furthermore, it will be more effective at defending a system from an attack as it will be less predictable. A dynamic model offers the best response based on the current situation of the network. Thus, the evaluation of the positive effects and negative impacts of the responses must be computed online, at attack time, in a dynamic model. We evaluate the response cost online with respect to the resources dependencies and the number of online users. In this paper, we present a practical framework with relevant factors for response cost evaluation. The proposed framework is a platform that leads us to account for the user?s needs in terms of quality of services (QoS) and the dependencies of critical processes. Compared with other response evaluation models, the proposed framework consists of not only a novel online mechanism for response cost evaluation in complex network topologies, but also more detailed factors to evaluate responses positive effect and negative impact. In addition, we discuss the main challenges to evaluate response cost with respect to the attack type.
response cost intrusion response resource dependency decision-making fuzzy logic