Département Réseau, Sécurité et Multimédia Rapport d'Activités 2008

Reaction after detectionResearch Staff : Frédéric Cuppens, Nora Cuppens-Boulahia, Yacine Bouzida, Aurélien CroissantKeywords : Alert management, attack response, security policy, OrBACApplications : Security Information Management (SIM), Intrusion Detection System (IDS)Partners & Funding : funded by European RED (Reaction After Detection) Celtic project.IntroductionRecent advances in intrusion detection havemade it possible to assess the different alertsgenerated from heterogeneous IDSs and reactefficiently against some a priori known threats.However, current prevention techniquesprovide restrictive responses that apply a localaction in a limited information systeminfrastructure.RED (Reaction After Detection) is a CELTICproject that aims to define an in depth andcomprehensive approach for responding tointrusions in a precise and efficient way. Thisnew direction considers not only the threat andthe architecture of the monitored informationsystem, but also the security policy; thecorresponding security objectives, thecontextal data and the different operationalconstraints. The proposed reaction workflowlinks the lowest level of the information systemcorresponding to intrusion detectionmechanisms, including misuse and anomalytechniques, and access control machanismswith the higher level of the security policy. Theproposed reaction workflow evaluates theintrusion alerts in three different levels: thelocal, intermediate and global levels. It thenreacts against threats with appropriate countermeasures in each level accordingly.This research work is funded by the EuropeanCELTIC project RED (Reaction After Detection).RealizationThe reaction mechanisms may be seen indifferent ways. One may react directly andlocally but the threat may propagate due tothe malicious strategy followed by the intruder.The second idea consists in considering thesecurity policy of the monitored informationsystem and reacting against the threats bytaking advantage of the security policy and itsflexibility to adapt the current specificationwith the detected threat.In RED, we suggest a mechanism that may beseen as an auto adaptive model that startsfrom the security policy management of themonitored information system. The differentspecifications of this information system areexpressed using the different securityobjectives and requirements in addition to thedifferent security rules that are expressed aspermissions, prohibitions and obligations.We suggest using the OrBAC (OrganizationbasedAccess Control) model to define asecurity policy that dynamically adapts tocurrent threats. Threat is characterizedthrough intrusion detection diagnoses. Oursystem triggers threat contexts whichdynamically activate security policy rulesensuring response [1]. In addition, OrBACprovides means to define a generic policy atthe abstract level, which is locally enforced atthe concrete level. This methodology facilitatesthe deployment of the policy at a large scale,and ensures to trigger different levels ofreactions, which are well-suited to face thedetected threat.The low level tools include intrusion detectionand access control mechanisms that areimplemented locally to monitor the informationsystem are configured according to the highlevel security specifications. Then, according tothe different alerts generated, the alerts areforwarded to the upper level whenever it isnecessary, after traversing the differentreaction levels, to evaluate the current systemstate where either direct responses arelaunched or the whole security policy ischanged according to the detected threat.We define three levels of reaction; (1) lowlevel reaction, (2) intermediate level reaction,and (3) high level reaction. Each levelconsiders particular security requirements anddeploys appropriate security components andmechanisms to react against the detectedthreats.The low level reaction corresponds to actionsthat are executed automatically just after anintrusion is detected. Therefore, it is possibleto immediately respond to an attack. This maybe done, for example, by adding a reaction tagPracom’s Annual Report 2008 43