Modeling the intrusion by using capability of attackers
Liangmin Wang, Jianming Zhang, Jian-Feng Ma · 2005
Modeling the intrusion is an open problem which is necessary to be solved in intrusion tolerance system. A model of state transition and its constructing algorithm is presented which is described with the capability of attackers. With the attention on the influence upon system, the intrusion is described by the capability of the attacker in this model. And the intrusion model is formalized by the definition of meta-attack. Then an approach to cluster the hyper-alerts into meta-attack using correlation-algorithm is presented. In the end, the method on modeling the intrusion by meta-attack is presented, and the proof of existence and uniqueness of the model constructed by this approach are given.