PrISM: Automatic Detection and Prevention from Cyber Attacks

Abstract

Network security is a discipline that focuses on securing networks from unauthorized access. Given the escalating threats of malicious cyber attacks, modern enterprises employ multiple lines of defense. A comprehensive defense strategy against such attacks should include: (1) an attack detection component that determines the fact that a system is compromised, (2) an attack identification and prevention component that identifies attack packets so that one can block such packets in the future and prevent the attack from further propagation. Over the last decade, significant research time has been invested in systems that can detect cyber attacks, either statically at compile time, or dynamically at run time. However, not much effort has been spent on automated attack packet identification or attack prevention. In this paper, we present a unified solution to these problems. We implemented this solution after reverse engineering an Open Source Security Information Management (OSSIM) system, called Preventive Information Security Management (PrISM) system, which correlates input from different sensors so that the resulting product can automatically detect any cyber attack against it, and prevent attack by identifying the actual attack packet(s). PrISM was always able to detect the attacks, identify the attack packets and most often prevent attack by blocking the attacker’s IP address to continue normal execution. There is no additional run-time performance overhead for attack prevention.