A Semi-Autonomic Framework for Intrusion Tolerance in Heterogeneous Networks

  • Salvatore D’Antonio
  • Simon Pietro Romano
  • Steven Simpson
  • Paul Smith
  • David Hutchison
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5343)


A suitable strategy for network intrusion tolerance— detecting intrusions and remedying them—depends on aspects of the domain being protected, such as the kinds of intrusion faced, the resources available for monitoring and remediation, and the level at which automated remediation can be carried out. The decision to remediate autonomically will have to consider the relative costs of performing a potentially disruptive remedy in the wrong circumstances and leaving it up to a slow, but more accurate, human operator. Autonomic remediation also needs to be withdrawn at some point – a phase of recovery to the normal network state.

In this paper, we present a framework for deploying domain-adaptable intrusion-tolerance strategies in heterogeneous networks. Functionality is divided into that which is fixed by the domain and that which should adapt, in order to cope with heterogeneity. The interactions between detection and remediation are considered in order to make a stable recovery decision. We also present a model for combining diverse sources of monitoring to improve accurate decision making, an important pre-requisite to automated remediation.


Intrusion Detection Anomaly Detection Intrusion Detection System Edge Router Decision Engine 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    The INTERSECTION Project,
  2. 2.
    Abad, C., Li, Y., Lakkaraju, K., Yin, X., Yurcik, W.: Correlation between netflow system and network views for intrusion detectionGoogle Scholar
  3. 3.
    Abad, C., Taylor, J., Sengul, C., Yurcik, W., Zhou, Y., Rowe, K.: Log correlation for intrusion detection: A proof of concept. In: Proceedings of the 19th Annual Computer Security Applications Conference, ACSAC (2003)Google Scholar
  4. 4.
    Armannsson, D., Smith, P., Hjalmtysson, G., Mathy, L.: Controlling the Effects of Anomalous ARP Behaviour on Ethernet Networks. In: CoNEXT 2005, Toulouse, France, October 2005, pp. 50–60 (2005)Google Scholar
  5. 5.
    Bace, R.G.: Intrusion Detection. Macmillan Technical Publishing, Basingstoke (2000)Google Scholar
  6. 6.
    Baker, A.R., Caswell, B., Poor, M.: Snort 2.1 Intrusion Detection, 2nd edn. Syngress (2004)Google Scholar
  7. 7.
    Balepin, I., Maltsev, S., Rowe, J., Levitt, K.: Using Specification-Based Intrusion Detection for Automated Response. In: Vigna, G., Krügel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol. 2820. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  8. 8.
    Debar, H., Curry, D., Feinstein, B.: The Intrusion Detection Message Exchange Format (IDMEF). Number 4765 in RFC. IETF (March 2007)Google Scholar
  9. 9.
    Gamer, T., Schöller, M., Bless, R.: A granularity-adaptive system for in-network attack detection. In: IEEE / IST Workshop on Monitoring, Attack Detection and Mitigation, Tuebingen, Germany, pp. 47–50 (September 2006)Google Scholar
  10. 10.
    Lakhina, A., Crovella, M., Diot, C.: Mining anomalies using traffic feature distributions. In: Proceedings of ACM SIGCOMM 2005 (August 2005)Google Scholar
  11. 11.
    Li, Z., Taylor, J., Partridge, E., Zhou, Y., Yurcik, W., Abad, C., Barlow, J.J., Rosendale, J.: Uclog: A unified, correlated logging architecture for intrusion detection. In: Proceedings of the 12th International Conference on Telecommunication Systems - Modeling and Analysis, ICTSM (2004)Google Scholar
  12. 12.
    Lindqvist, U., Porras, P.A.: Detecting computer and network misuse through the production-based expert system toolset (p-best). In: Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland, California, May 1999, pp. 146–161. IEEE Computer Society Press, Los Alamitos (1999)Google Scholar
  13. 13.
    Mahoney, M.V.: Network traffic anomaly detection based on packet bytes. In: Proceedings of ACM SAC 2003 (2003)Google Scholar
  14. 14.
    Paxson, V., Terney, B.: Bro reference manual (2004)Google Scholar
  15. 15.
    Xie, L., Smith, P., Jabbar, A., Banfield, M., Leopold, H., Hutchison, D., Sterbenz, J.P.G.: From Detection to Remediation: A Self-Organized System for Addressing Flash Crowd Problems. In: IEEE International Conference on Communications (ICC 2008), Beijing, China (May 2008)Google Scholar
  16. 16.
    Yin, X., Yurcik, W., Treaster, M., Li, Y., Lakkaraju, K.: Visflowconnect: netflow visualizations of link relationships for security situational awareness. In: Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security, pp. 26–34. ACM Press, New York (2004)Google Scholar
  17. 17.
    Zhang, Y., Luo, J., Lu, H. (eds.): Wireless Mesh Networking Architecture, Protocols and Standards. Auerbach Publications (2007)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Salvatore D’Antonio
    • 1
  • Simon Pietro Romano
    • 2
  • Steven Simpson
    • 3
  • Paul Smith
    • 3
  • David Hutchison
    • 3
  1. 1.CINI – ITeM LaboratoryNapoliItaly
  2. 2.University of Napoli “Federico II”NapoliItaly
  3. 3.Computing Department, InfoLab21Lancaster UniversityLancasterUK

Personalised recommendations