NDLI: Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures

Please wait, while we are loading the content...

Integrated Adaptive Cyber Defense: Integration Spiral Results

Action Recommendation for Cyber Resilience

Using Probability Densities to Evolve more Secure Software Configurations

Automated Decision Making for Active Cyber Defense: Panel Discussion

Cyber Resilience-by-Construction: Modeling, Measuring & Verifying

Policy Specialization to Support Domain Isolation

Estimating Risk Boundaries for Persistent and Stealthy Cyber-Attacks

FlowMon: Detecting Malicious Switches in Software-Defined Networks

Who Touched My Mission: Towards Probabilistic Mission Impact Assessment

A Security Enforcement Framework for Virtual Machine Migration Auction

Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures

Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures

Content Provider	ACM Digital Library
Author	Jensen, Jeffrey L. Carroll, Thomas E. Paulson, Patrick C. Noonan, Christine F. Fink, Glenn A. Best, Daniel M. Thompson, Seth R. Oehmen, Christopher S. Peterson, Elena S.
Abstract	As cyber attacks on enterprise systems and critical infrastructure increase in prevalence and severity, persistent presence of adversaries in these systems is a common theme. While there are many efforts and tools focused on locating and removing adversaries from cyber systems, there is an increasing need for automated, steerable response that happens in attack-relevant time scales-an active cyber defense. The research presented here describes design and implementation of a system (SEQUESTOR) to achieve a form of active defense at the network layer by using the output of multiple behavior models to drive differential routing of traffic through a core network. This approach is based on two assertions: 1) methods for detecting behavior that are inconsistent with a user's past are a proxy for compromised systems or credentials, but are subject to high rate of false positives; and 2) automatically changing the logical route taken by future traffic emanating from the potentially compromised system provides a means for graded response that makes is possible to balance the cost of false positive with the risk of allowing the behavior to continue. The presented system is a framework that combines behavior models in a modular way and allows for future models and responses to be incorporated. Ultimately, this is a model for how real-time situational awareness technologies can be coupled to automated responses as well as supporting steerable responses that provide decision support to human operators.
Starting Page	55
Ending Page	58
Page Count	4
File Format	PDF
ISBN	9781450338219
DOI	10.1145/2809826.2809835
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2015-10-12
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Behavior models Anomaly response Routing
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in