Limiting Uncertainty in Intrusion Response Curtis A. Carver Jr. John M.D. Hill Udo W. Pooch

Agenda Motivation Adaptive, Agent-based Intrusion Response System (AAIRS) Uncertainty in Detection Uncertainty in Classifying Attacks Uncertainty in Response Conclusions 6/5/2001 SMC-IAW

Motivation (CERT Incidents) The number of computer attacks is increasing and the attacks are becoming increasingly complex. 6/5/2001 SMC-IAW

Motivation (Intrusion Response Systems) Intrusion response systems must address uncertainty. Response systems should provide automated mechanisms for adapting to uncertainty in intrusion response. Of the systems surveyed, none provided mechanisms for answering the following questions: IR Classification # Notification 31 Manual Response 8 Automatic Response 17 Total 56 6/5/2001 SMC-IAW

Uncertainty in Intrusion Response Is the system really under attack? If the system is under attack, is this a new attack or part of an ongoing attack? Did my response plan work and if it did not, how can I adapt it? 6/5/2001 SMC-IAW

AAIRS Methodology Monitored System Response Toolkit System Admin Tool Intrusion Detection System System Admin Tool Response Toolkit Interface Master Analysis Response Taxonomy Policy Specification Monitored System 6/5/2001 SMC-IAW

Uncertainty (Detection) Intrusion detection is imperfect. AAIRS addresses uncertainty in detection by maintaining a false alarm rate on each supported intrusion detection system. The false alarm rate is maintained by the system administrator but could be updated automatically by calibrating the false alarm rate. 6/5/2001 SMC-IAW

Uncertainty (Classifying Attacks) Detected attacks can be a new attack or part of an ongoing attack. Event List History Time Metric Session Identifier Attack Type Metric 6/5/2001 SMC-IAW

Uncertainty in Response Response plan consists of a response goal, two or more plan steps, and associated tactics and implementations. Each plan step, tactic, and implementation has an associated success factor. The success factor is the ratio of the number of times it has been successfully deployed to the total number of times it has been deployed. 6/5/2001 SMC-IAW

Uncertainty in Response Plan Generation Apply Policy Constraints Set Response Taxonomy Weights Determine System Response Goal Weights Build Tentative Plan Build Final Plan Implementation Success or Failure Plan Adaptation Failed Implementation Substitution Tactic Substitution Significant Change Adaptation 6/5/2001 SMC-IAW

Conclusions Must manage uncertainty in intrusion response system. The techniques presented in this paper provide a starting point for addressing this uncertainty. 6/5/2001 SMC-IAW