Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

attacks. This approach automatically discoversbased on the description of elementaryattacks. In order to describe the attacks andthe counter-measures available to theresponse module, we have designed theLAMBDA language.We have defined a set of predicates to specifyboth network and system attacks in LAMBDAand developed a CRIM module that provides afriendly interface to specify attacks in LAMBDA.This module is currently being tested in thecontext of ad-networks and VOIP (Voice OverIP) intrusions.The response functionality implemented inCRIM is based on the anti-correlation principlewhich provides means to automatically selectpossible counter-measures capable of endingthe detected intrusion [3]. This approach usesa library of counter-measures also specified inthe LAMBDA language. However, countermeasuresmay actually have side effects andcan be as harmful as the detected attack. Todeal with this issue, we improve the reactionselection process by giving means to quantifythe effectiveness and select the countermeasurethat has the minimum negative sideeffect on the information system. To achievethis goal, we adopt a risk assessment andanalysis approach [4].The various CRIM modules presented abovehave been implemented in C++ and tested onseveral realistic scenarios. The software isregistered at the APP (Agence pour laProtection des Programmes) with referenceIDDN.FR.001.250007.000.R.P.2005.000.10000.ConclusionThe CRIM modules have all been implementedand tested on alerts generated by open sourceprobe, especially Snort and Bro. Researchesare still ongoing in the RED project to testCRIM and enhance the response function.References[1] F. Autrel, F. Cuppens. CRIM: un module decorrélation d'alertes et de réaction auxattaques. Annals of Telecommunications. Vol.61, no. 9-10. September-October 2006.[2] F. Cuppens et A. Miège. Alert correlation ina cooperative intrusion detection framework.IEEE Symposium on Research in Security andPrivacy, Oakland, May 2002.[3] F. Cuppens, F. Autrel, Y. Bouzida, J. García,S. Gombault, and T. Sans. Anti-correlation as acriterion to select appropriate countermeasuresin an intrusion detection framework.Annals of Telecommunications. Vol. 61, no. 1-2. January-February 2006.[4] W. Kanoun, N. Cuppens-Boulahia, F.Cuppens, F. Autrel. Advanced Reaction usingRisk Assessment in Intrusion DetectionSystems. 2nd International Workshop onCritical Information Infrastructures Security(CRITIS), Malaga, Spain, October, 2007.Threat response by policy revisionResearch Staff : Frédéric Cuppens, Nora Cuppens-Boulahia – Ph.D. Students: Yohann ThomasKeywords : Alert management, attack response, security policy, OrBACApplications : Security Information Management (SIM), Intrusion Detection System (IDS)Partners & Funding : partially funded by France Telecom R&D and ANRT through CIFRE conventionIntroductionInformation systems security is realizedthrough the use of different technologies,some of them being preventive, such asauthentication, encryption and access control,and others being corrective, such as antivirusesand intrusion detection systems. Thesedifferent tools are deployed with respect to apredefined security policy, which aims atdescribing what should be done to preserveconfidentiality, integrity and availability of theresources and services.Intrusion detection aims at reporting alertscharacterizing violations of the security policy,in particular linked with malicious activity(attacks) [1]. However, most of the time,Pracom’s report 2008 41