Towards Autonomic Intrusion Response Systems

Intrusion Response Systems (IRSs) have been a major research topic in the last decade. At the core of an IRS is the response selection algorithm, which selects the best response action to counter the currently detected attack. This work advances the state of the art by proposing a meta-model based on Multi-Agent Markov Decision Processes which can be used to model a system and to plan for multi-objective, optimal, long-term, eventually proactive response policies. Experimental results show that long-term policies always outperform short-term ones and a thorough performance assessment shows that the proposed approach can be adopted to secure large systems.