Method of risk analysis in an automatic intrusion response system

• US 20050144480A1
• Filed: 12/10/2004
• Published: 06/30/2005
• Est. Priority Date: 12/29/2003
• Status: Abandoned Application

• Current Assignee: Korea Information Security Agency
• Original Assignee: Korea Information Security Agency
• Inventors: Lee, Ho Jae, Lee, Hong Sub, Lee, Kang Shin, Choi, Chung Sup, Kim, Young Tae
• Application Number:
  US11/009,207
• Publication Number:
  US 20050144480A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

The present invention relates to a method of risk analysis in an automatic intrusion response system that provides computer-related security in a large scale dynamic network environment, comprising: (a) classifying intrusion detection information by using IDMEF data model; (b) establishing a risk assessment knowledge base; (c) learning rules of said knowledge base; and (d) assessing the risk level of an external attack based upon said knowledge base. Said risk level is determined by parameters such as intrusion detection information, weakness information, network bandwidth, system performance and importance, and frequency of attacks, etc.

Claims

1. A method of risk analysis in an automatic intrusion response system that provides computer-related security in a dynamic network environment, comprising:

(a) classifying intrusion detection information by using an IDMEF data model;

(b) establishing a risk assessment knowledge base;

(c) learning rules in said knowledge base; and

(d) assessing the risk level of an external attack based upon said learned knowledge base.

2. The method according to claim 1, wherein said assessing of risk level is by parameters such as intrusion detection information, weakness information, network bandwidth, system performance and importance, and frequency of attacks.

3. The method according to claim 1, wherein said dynamic network environment is a large-scale distributed network environment.

4. The method according to claim 1, wherein said IDMEF data model includes definitions of data format and exchange procedures for sharing information among an intrusion detection system, a response system and a management system of said automatic intrusion response system.

5. The method according to claim 1, wherein said knowledge base is established by referring to weakness information.

6. The method according to claim 1, wherein said (c) learning of rules in the knowledge base uses C4.5 machine learning technique.

7. The method according to claim 1, wherein said (d) assessing the risk level of an external attack based upon said learned knowledge base uses the AdaBoost meta learning technique.