From Attach Trees to Timed Stochastic Games: A Novel Intrusion Response Approach

Abstract:  

Most dynamic Intrusion Response Systems (IRSs) use models to characterize the attack patterns and the dynamics of the protected system. They are typically based on some mathematical framework and require a low-level modeling activity that is often difficult and error-prone, even for the experienced end-user. Furthermore, most of the model-based approaches proposed so far do not structurally include the notion of time, which is necessary to model non-instantaneous defense and attack actions. In this seminar, we present a novel methodology for the automatic generation of IRSs based on Timed Competitive Stochastic Games from augmented Attack-Defense Trees (ADT), a formalism that is commonly used to represent attack patterns and to build IRSs based on a static mapping between attack and response. We formally and empirically prove
that: (i) using a static mapping between attack and response or selecting the action with the immediate minimum cost to counter the attack without long-term planning leads to an underestimation of the defense cost; (ii) the total defense cost of a defense policy obtained with an IRS based on the proposed methodology is lower than or equal to the defense cost that can be obtained with an IRS based on static mapping; (iii) not considering time leads to an underestimation of the defense cost.
We then show experimental results on the scalability of the proposed approach in terms of planning time and memory usage.

Bio:

Stefano Iannucci is an Associate Professor of Computer Engineering at Roma Tre University and an Adjunct Professor of Computer Science and Engineering at Mississippi State University. He received his Ph.D. in 2015 from the University of Rome “”Tor Vergata””. His research focuses on autonomic computing, with special focus on self-protecting systems, and performance modeling and benchmarking.

He published over 30 papers in top journals and conferences. Dr. Iannucci is Associate Editor of Springer Cluster Computing, part of the Review Board of IEEE Transactions on Parallel and Distributed Systems and has served in the program committees of major international conferences in Cloud/Autonomic Computing and Performance Engineering.