Towards an integrated defense system for cyber security situation awareness experiment
Hanlin Zhang, Sixiao Wei, Linqiang Ge, Dan Shen, Wei Yu, Erik Blasch, Khanh Pham, Genshe Chen · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · 2015
In this paper, an implemented defense system is demonstrated to carry out cyber security situation awareness. The developed system consists of distributed passive and active network sensors designed to effectively capture suspicious information associated with cyber threats, effective detection schemes to accurately distinguish attacks, and network actors to rapidly mitigate attacks. Based on the collected data from network sensors, image-based and signals-based detection schemes are implemented to detect attacks. To further mitigate attacks, deployed dynamic firewalls on hosts dynamically update detection information reported from the detection schemes and block attacks. The experimental results show the effectiveness of the proposed system. A future plan to design an effective defense system is also discussed based on system theory.