A Probabilistic Approach to Autonomic Security Management

Iannucci, S., & Abdelwahed, S. (2016). A Probabilistic Approach to Autonomic Security Management. Proceedings of IEEE International Conference on Autonomic Computing (ICAC '16). Wurzburg, Germany: IEEE.

Intrusion Response Systems (IRSs) have been a major research topic in the last decade. At the core of an IRS is the response selection algorithm, which selects the best response action to counter the currently detected attack. Most of the IRSs proposed so far, statically or dynamically evaluate the mapping between response actions and specific attacks, ignoring the actual system state, thus providing only short-term decisions. In this paper we propose a controller based on Markov Decision Process (MDP) for an autonomic IRS. The proposed controller is able to compose atomic response actions to create optimal long-term response policies to protect a system. Experimental results show that long-term policies are always more effective than short-term policies and that they can reduce the threat resolution time up to 56% in the considered scenario.