Detection and avoidance of routing attack in mobile ad-hoc network using intelligent node

The routing attacks are created in order to damage the network in Mobile Ad-hoc. Previously, Dempster-shafer theory introduced a solution for these routing attacks where it entirely works on the principle of Dempster rule with various important factors to mitigate these critical routing attacks. Previously the system contains an Intrusion detection mechanism which is used to create a message whenever the attacker attacks the network. This Intrusion detection system sends an alert message to each mobile node in the network, when the attacker attacks the network. Then, Routing table change Detector identifies exactly how many changes has occurred in each node after receiving the alert messages from the intrusion detection system and also it make some changes in the routing table of each node in the network. From these changes, the Intrusion detection system identifies the attackers and these attackers are isolated from the network. The main drawback of this existing system is whenever the attacker is occurred, the Intrusion detection system has to send an alert message every time and the routing table change detector has to make some changes in the routing table. In order to avoid these drawbacks, the knowledge based intelligent system is proposed. In this proposed system, initially a source node has to get an authorized path from the intelligent node (a node with high energy) to send a data to the destination node. This proposed system discussed with the four routing attacks such as route salvage, sleep deprivation, colluding miss relay and collision attack

Towards automated incident handling: how to select an appropriate response against a network-based attack?

The increasing amount of network-based attacks evolved to one of the top concerns responsible for network infrastructure and service outages. In order to counteract these threats, computer networks are monitored to detect malicious traffic and initiate suitable reactions. However, initiating a suitable reaction is a process of selecting an appropriate response related to the identified network-based attack. The process of selecting a response requires to take into account the economics of an reaction e.g., risks and benefits. The literature describes several response selection models, but they are not widely adopted. In addition, these models and their evaluation are often not reproducible due to closed testing data. In this paper, we introduce a new response selection model, called REASSESS, that allows to mitigate network-based attacks by incorporating an intuitive response selection process that evaluates negative and positive impacts associated with each countermeasure. We compare REASSESS with the response selection models of IE-IRS, ADEPTS, CS-IRS, and TVA and show that REASSESS is able to select the most appropriate response to an attack in consideration of the positive and negative impacts and thus reduces the effects caused by an network-based attack. Further, we show that REASSESS is aligned to the NIST incident life cycle. We expect REASSESS to help organizations to select the most appropriate response measure against a detected network-based attack, and hence contribute to mitigate them

A risk index model for security incident prioritisation

With thousands of incidents identified by security appliances every day, the process of distinguishing which incidents are important and which are trivial is complicated. This paper proposes an incident prioritisation model, the Risk Index Model (RIM), which is based on risk assessment and the Analytic Hierarchy Process (AHP). The model uses indicators, such as criticality, maintainability, replaceability, and dependability as decision factors to calculate incidents’ risk index. The RIM was validated using the MIT DARPA LLDOS 1.0 dataset, and the results were compared against the combined priorities of the Common Vulnerability Scoring System (CVSS) v2 and Snort Priority. The experimental results have shown that 100% of incidents could be rated with RIM, compared to only 17.23% with CVSS. In addition, this study also improves the limitation of group priority in the Snort Priority (e.g. high, medium and low priority) by quantitatively ranking, sorting and listing incidents according to their risk index. The proposed study has also investigated the effect of applying weighted indicators at the calculation of the risk index, as well as the effect of calculating them dynamically. The experiments have shown significant changes in the resultant risk index as well as some of the top priority rankings

A Taxonomy of Intrusion Response Systems

Recent advances in intrusion detection field brought new requirements to intrusion prevention and response. Traditionally, the response to an attack was manually triggered by an administrator. However, increased complexity and speed of the attack-spread during recent years showed acute necessity for complex dynamic response mechanisms. Although intrusion detection systems are being actively developed, research efforts in intrusion response are still isolated. In this work we present taxonomy of intrusion response systems, together with a review of current trends in intrusion response research. We also provide a set of essential fetures as a requirement for an ideal intrusion response system

Ускорение расчетов оценки защищенности пользователей информационной системы за счет элиминации маловероятных траекторий социо-инженерных атак

In the field of information security it is necessary to develop scientific and proved and mathematical methods and the models reflecting specifics of subject domain for ensuring activity of experts, allowing to automate the analysis of information systems user’s security from socio-engineering attacks. The purpose of this paper is consideration of a method of of success probability search of socio-engineering attacking impact on each user in the "personnel - information system - critical documents" complex where users and communications between them are presented as graph. The algorithm assumes search of various acyclic ways between two users.Для обеспечения деятельности специалистов в области информационной безопасности необходимо разработать научно-обоснованные и отражающие специфику предметной области математические методы и модели, позволяющие автоматизировать анализ защищенности пользователей информационных систем от социо-инженерных атак. Целью настоящей работы является рассмотрение метода поиска вероятности успеха социо-инженерного атакующего воздействия на каждого пользователя в комплексе «персонал - информационная система – критичные документы», пользователи которого и связи между ними представлены виде графа. Алгоритм предполагает поиск всевозможных ациклических путей между двумя пользователями

Анализ защищенности пользователей информационных систем на основе графических моделей, содержащих профили уязвимостей

The problem of critical information protection is now one of the most actual in in-formation technologies though it is necessary to recognize that, from the historical point of view, closely related to it problems arose much earlier — probably, at the same time with writing emergence. The standard approach to the solution of these problems consists in development, diversification and complication of applied technical measures of safety. Thus possibilities of technical attacks to systems are minimized. At the same time, each protected information system has the authorized users who work at the lawful bases in it and often have legal access to confidential information. The purpose of this article is creation of an analysis algorithm of resistance of users of information systems from socio-engineering attacks taking into account a profile of vulnerabilities of the user.Проблема защиты критичной информации в настоящее время является одной из самых актуальных в информационных технологиях, хотя нельзя не признать, что, с исторической точки зрения, близкородственные ей проблемы зародились гораздо раньше — видимо, одновременно с возникновением письменности. Общепринятый подход к решению данных проблем заключается в развитии, диверсификации и усложнении применяемых технических мер обеспечения безопасности. Таким образом минимизируются возможности технических атак на системы. В то же время, каждая защищаемая информационная система имеет санкционированных пользователей, которые на законных основаниях работают в ней и зачастую имеют легальный доступ к конфиденциальной информации. Целью данной статьи является построение алгоритма анализа резистентности пользователей информационных систем от социо-инженерных атак с учетом профиля уязвимостей пользователя

The Methodology for Evaluating Response Cost for Intrusion Response Systems

Recent advances in the field of intrusion detection brought new requirements to intrusion prevention and response. Traditionally, the response to the detected attack was selected and deployed manually, in the recent years the focus has shifted towards developing automated and semi-automated methodologies for responding to intrusions. In this context, the cost-sensitive intrusion response models have gained the most interest mainly due to their emphasis on the balance between potential damage incurred by the intrusion and cost of the response. However, one of the challenges in applying this approach is defining consistent and adaptable measurement of these cost factors on the basis of requirements and policy of the system being protected against intrusions. In this paper we present a structured methodology for evaluating cost of responses based on three factors: the response operational cost associated with the daily maintenance of the response, the response goodness that measures the applicability of the selected response for a detected intrusion and the response impact on the system that refers to the possible response effect on the system functionality. The proposed approach provides consistent basis for response evaluation across different systems while incorporating security policy and properties of specific system environment. We demonstrate the advantages of the proposed cost model and evaluate it on the example of three systems

Home-Based Intrusion Detection System

Wireless network security has an important role in our daily lives. It has received significant attention, although wireless communication is facing different security threats. Some security efforts have been applied to overcome wireless attacks. Unfortunately, complete attack prevention is not accurately achievable. Intrusion Detection System (IDS) is an additional field of computer security. It is concerned with software that can distinguish between legitimate users and malicious users of a computer system and make a controlled response when an attack is detected. The project proposed to develop IDS technology on the windows platform. The IDS adopted misuse detection, which is based on signature recognition. The main objective of this proposal is to detect any network vulnerabilities and threats that concern home-based attacks or intrusion. There are five steps in our methodology: The first step is to create awareness of the problem by understanding the purpose and scope of the learning, as well as the problem, which are necessary to be solved. The second step is to make suggestion that the intrusion detection system is protecting the network of the homes. The third step is to develop signature by establishing a set of rule thorough processes for testing IDS. The fourth step is evaluating and testing the system that has been developed. This design used the sensor to find and match activity signatures found in the checked environment to the known signatures in the signature database. Finally, the conclusion in this phase showed the results of the study and the achievement of the objectives of the study. This IDS project will contribute to the efforts to protect users from the internal and external intruders