Matching information security vulnerabilities to organizational security profiles: a genetic algorithm approach

Authors:
Mukul Gupta;Jackie Rees;Alok Chaturvedi;Jie Chi
Affiliations:
Department of Operations and Information Management, School of Business, University of Connecticut, Storrs, CT;Krannert Graduate School of Management, Purdue University, West Lafayette, IN;Krannert Graduate School of Management, Purdue University, West Lafayette, IN;Purdue e-Business Research Center, Purdue University, West Lafayette, IN
Venue:
Decision Support Systems - Special issue: Intelligence and security informatics
Year:
2006

Citing 3
Cited 4

An updated survey of GA-based multiobjective optimization techniques

ACM Computing Surveys (CSUR)
Genetic Algorithms in Search, Optimization and Machine Learning

Genetic Algorithms in Search, Optimization and Machine Learning
Introduction to Algorithms

Introduction to Algorithms

Network externalities, layered protection and IT security risk management

Decision Support Systems
Optimal security hardening using multi-objective optimization on attack tree models of networks

Proceedings of the 14th ACM conference on Computer and communications security
Using case-based reasoning for the design of controls for internet-based information systems

Expert Systems with Applications: An International Journal
Identifying disgruntled employee systems fraud risk through text mining: A simple solution for a multi-billion dollar problem

Decision Support Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Organizations are making substantial investments in information security to reduce the risk presented by vulnerabilities in their information technology (IT) infrastructure. However, each security technology only addresses specific vulnerabilities and potentially creates additional vulnerabilities. The objective of this research is to present and evaluate a Genetic Algorithm (GA)- based approach enabling organizations to choose the minimal-cost security profile providing the maximal vulnerability coverage. This approach is compared to an enumerative approach for a given test set. The GA-based approach provides favorable results, eventually leading to improved tools for supporting information security investment decisions.