An Event-Driven Architecture for Fine Grained Intrusion Detection and Attack Aftermath Mitigation

  • Authors:

  • Jianfeng Peng;Chuan Feng;Haiyan Qiao;Jerzy Rozenblit

  • Affiliations:

  • The University of Arizona, USA;The University of Arizona, USA;The University of Arizona, USA;The University of Arizona, USA

  • Venue:
  • ECBS '07 Proceedings of the 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

In today's computing environment, unauthorized accesses and misuse of critical data can be catastrophic to personal users, businesses, emergency services, and even national defense and security. To protect computers from the ever-increasing threat of intrusion, we propose an event-driven architecture that provides fine grained intrusion detection and decision support capability. Within this architecture, an incoming event is scrutinized by the Subject-Verb- Object multipoint monitors. Deviations from normal behavior detected by SVO monitors will trigger different alarms, which are sent to subsequent fusion and verification modules to reduce the false positive rate. The system then performs impact analysis by studying real-time system metrics, collected through the Windows Management Instrumentation interface. We add to the system the capability to assist the administrator in taking effective actions to mitigate the aftermath of an intrusion.