Real-time risk assessment with network sensors and intrusion detection systems

Authors:
André Årnes;Karin Sallhammar;Kjetil Haslum;Tønnes Brekne;Marie Elisabeth Gaup Moe;Svein Johan Knapskog
Affiliations:
Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway;Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway;Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway;Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway;Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway;Centre for Quantifiable Quality of Service in Communication Systems, Norwegian University of Science and Technology, Trondheim, Norway
Venue:
CIS'05 Proceedings of the 2005 international conference on Computational Intelligence and Security - Volume Part II
Year:
2005

Citing 4
Cited 7

A tutorial on hidden Markov models and selected applications in speech recognition

Readings in speech recognition
An Architecture for Intrusion Detection Using Autonomous Agents

ACSAC '98 Proceedings of the 14th Annual Computer Security Applications Conference
Applications of Hidden Markov Models to Detecting Multi-Stage Network Attacks

HICSS '03 Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9 - Volume 9
Lightweight agents for intrusion detection

Journal of Systems and Software

Information Assurance: Dependability and Security in Networked Systems

Information Assurance: Dependability and Security in Networked Systems
Multisensor Real-Time Risk Assessment Using Continuous-Time Hidden Markov Models

Computational Intelligence and Security
TSR: trust-based secure MANET routing using HMMs

Proceedings of the 4th ACM symposium on QoS and security for wireless and mobile networks
Online Risk Assessment of Intrusion Scenarios Using D-S Evidence Theory

ESORICS '08 Proceedings of the 13th European Symposium on Research in Computer Security: Computer Security
Asset priority risk assessment using hidden markov models

Proceedings of the 10th ACM conference on SIG-information technology education
Using hidden markov models to evaluate the risks of intrusions

RAID'06 Proceedings of the 9th international conference on Recent Advances in Intrusion Detection
Game theory meets network security and privacy

ACM Computing Surveys (CSUR)

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper considers a real-time risk assessment method for information systems and networks based on observations from networks sensors such as intrusion detection systems. The system risk is dynamically evaluated using hidden Markov models, providing a mechanism for handling data from sensors with different trustworthiness in terms of false positives and negatives. The method provides a higher level of abstraction for monitoring network security, suitable for risk management and intrusion response applications.