Paper Info
Title
Policy-based security configuration management application to intrusion detection and prevention
Abstract
Intrusion Detection and/or Prevention Systems (IDPS) represent an important line of defense against the variety of attacks that can compromise the security and well functioning of an enterprise information system. IDPSes can be network or host-based and can collaborate in order to provide better detections of malicious traffic. Although several IDPS systems have been proposed, their appropriate configuration and control for effective detection and prevention of attacks has always been far from trivial. Another concern is related to the slowing down of system performance when maximum security is applied, hence the need to trade off between security enforcement levels and the performance and usability of an enterprise information system. In this paper we motivate the need for and present a policy-based framework for the configuration and control of the security enforcement mechanisms of an enterprise information system. The approach is based on dynamic adaptation of security measures based on the assessment of system vulnerability and threat prediction and provides several levels of attack containment. As an application, we have implemented a dynamic policy-based adaptation mechanism between the Snort signature-based IDPS and the light weight anomaly-based FireCollaborator IDS. Experiments conducted over the DARPA 2000 and 1999 intrusion detection evaluation datasets show the viability of our framework.
Year
DOI
Venue
2009
10.1109/ICC.2009.5199341
ICC
Keywords
Field
DocType
maximum security,enterprise information system,system performance,security enforcement mechanism,better detection,idps system,system vulnerability,security enforcement level,policy-based security configuration management,intrusion detection,appropriate configuration,snort signature-based idps,intrusion prevention,information security,data mining,indexing terms,computer security,collaboration,configuration management,control systems,data security,information systems,entropy,computer networks,risk management,security management
Information system,Network security policy,Computer security,Computer science,Computer network,Enterprise information system,Risk management,Configuration management,Security information and event management,Intrusion detection system,Vulnerability
Conference
ISSN
Citations 
PageRank 
1550-3607
4
0.52
References 
Authors
11
4
Name
Order
Citations
PageRank
Khalid Alsubhi1323.44
Issam Aib220415.19
Jérôme François317021.81
Raouf Boutaba46453404.30