An event-driven architecture for fine grained intrusion detection and attack aftermath mitigation

Jianfeng Peng, Chuan Feng, Haiyan Qiao, Jerzy Rozenblit

Research output: Chapter in Book/Report/Conference proceedingConference contribution

4 Scopus citations

Abstract

In today's computing environment, unauthorized accesses and misuse of critical data can be catastrophic to personal users, businesses, emergency services, and even national defense and security. To protect computers from the ever-increasing threat of intrusion, we propose an event-driven architecture that provides fine grained intrusion detection and decision support capability. Within this architecture, an incoming event is scrutinized by the Subject-Verb-Object multipoint monitors. Deviations from normal behavior detected by SVO monitors will trigger different alarms, which are sent to subsequent fusion and verification modules to reduce the false positive rate. The system then performs impact analysis by studying real-time system metrics, collected through the Windows Management Instrumentation interface. We add to the system the capability to assist the administrator in taking effective actions to mitigate the aftermath of an intrusion.

Original languageEnglish (US)
Title of host publicationProceedings - 14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, ECBS 2007
Subtitle of host publicationRaising Expectations of Computer-Based Systems
Pages55-60
Number of pages6
DOIs
StatePublished - 2007
Event14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, ECBS 2007 - Tucson, AZ, United States
Duration: Mar 26 2007Mar 29 2007

Publication series

NameProceedings of the International Symposium and Workshop on Engineering of Computer Based Systems

Other

Other14th Annual IEEE International Conference and Workshops on the Engineering of Computer-Based Systems, ECBS 2007
CountryUnited States
CityTucson, AZ
Period3/26/073/29/07

ASJC Scopus subject areas

  • Hardware and Architecture
  • Software

Fingerprint Dive into the research topics of 'An event-driven architecture for fine grained intrusion detection and attack aftermath mitigation'. Together they form a unique fingerprint.

Cite this