Simulating adversarial interactions between intruders and system administrators using OODA-RR
T. J. Grant, Hein S. Venter, Jan H. P. Eloff · 2007
Intrusion in information systems is a major problem in security management. Present-day intrusion detection systems detect attacks too late to counter them in real-time. Several authors in the digital forensics literature have proposed using Boyd's Observe-Orient-Decide-Act (OODA) model for intrusion protection, but none have taken these proposals further. This paper reports on hand-simulation of the adversarial interaction between an intruder and a system administrator intended to demonstrate the feasibility of implementing a rationally reconstructed OODA (OODA-RR) model. An OODA-RR test-bed is currently being implemented.