Seclius: An Information Flow-Based, Consequence-Centric Security Metric

Saman Zonouz

doi:10.1109/TPDS.2013.162

Seclius: An Information Flow-Based, Consequence-Centric Security Metric

2015-02-01

16

PRE

AI

DOI：10.1109/TPDS.2013.162

Original

Original request for help

Save

Abstract

En 中文

It is critical to monitor IT systems that are part of energy delivery system infrastructure. The problem with intrusion detection systems (IDSes) is that they often produce thousands of alerts daily that must be dealt with by administrators manually. To provide situational awareness, detection systems usually employ (alert, priority) mappings that are either built in the IDS without consideration of the high-level mission objectives of the infrastructure, or manually defined by administrators through a time-consuming task that requires deep system-level expertise. In this paper, we present Seclius, an online security evaluation framework that translates low-level IDS alerts into a high-level system security measure and provides a ranking of past malicious events and affected system assets based on how crucial they are for the organization. Seclius significantly reduces human involvement by automatically learning system characteristics, providing a simple formalism that administrators can use to define security requirements. Experiments on a process control network with real vulnerabilities and a multistep attack show that Seclius can accurately report system security with low performance overhead and support the time-constrained security decision-making process that is necessary for critical infrastructure.

Keywords:

Intrusion detection systems

system security metric

information flow-based analysis

Seclius: An Information Flow-Based, Consequence-Centric Security Metric

Abstract

AI Summary

Journal

Organization