A credible cost-sensitive model for intrusion response selection

Abstract

The goal of co st-sensitive response system is to ensure that response cost does not outweigh the intrusion cost. In order to ensure this, some cost-sensitive response models have been developed. Some of these models do not consider the effectiveness of previous actions and lack standard approach for estimating associated cost. In this work, we present a model for assessing cost of responses based on three factors, the cost of damage caused by the intrusion, the cost of automatic response to an intrusion and the operational cost. The proposed approach provides consistent basis for response assessment across different systems and environment. In addition, the performance analysis indicates that automated responses systems using this cost metric COSIRS, when deployed can responds quickly enough to thwart active attacks in real time using optimal responses. The results of evaluation show that the design has better performance over existing ones.