Game Theory Model for Intrusion Prevention in Computer Networks
No system is completely secure, but it’s possible to analyze system vulnerabilities, take security measures and thus reduce the likelihood of system intrusions. One tool to reduce this probability of intrusion is to implement intrusion prevention systems, which analyze network traffic to determine anomalous behavior and take security measures with the agents that exhibit these behaviors. This document proposes a game theory model based in an evaluation of works related in the area that could be the basis of an algorithm for the prevention of intrusions in networks.
DFA-AD: a distributed framework architecture for the detection of advanced persistent threats
Advanced persistent threats (APTs) are target-oriented and advanced cyber-attacks which often leverage the bot control and customized malware techniques in order to control and remotely access valuable information. APTs generally use various attack techniques to gain access to the unauthorized system and then progressively spread throughout the network. The prime objectives of APT attacks are to steal intellectual property, legal documents, sensitive internal business and other data. If an attack is successfully launched on a system, the timely detection of attack is extremely important to stop APTs from further spreading and for mitigating its impact. On the other hand, internet of things (IoT) devices quickly become ubiquitous while IoT services become pervasive. Their prosperity has not gone unnoticed, and the number of attacks and threats against IoT devices and services are also increasing. Cyber-attacks are not new to IoT, but as the IoT will be deeply intertwined in our societies and lives, it becomes essential to take cyber defense seriously. In this paper, we propose a novel distributed framework architecture for the detection of APTs named as distributed framework architecture for APTs detection (DFA-AD), which is a promising basis for modern intrusion detection systems. In contrast to other approaches, the DFA-AD technique for detecting APT attack is based on multiple parallel classifiers, which classify the events in a distributed environment and event correlation among those events. Each classifier method is focused on detecting the APT’s attack technique independently. The evaluation results show that the proposed approach achieves greater effectiveness and accuracy.
An Approach to Mitigating Sybil Attack in Wireless Networks using ZigBee
Various sensors employing ZigBee protocol send environment information to a home gateway. The home gateway manages every devices, sensors and services according to the information. However, if an attacker fabricates the information with malevolent purpose, the system may perform any inadvertent service, which may be harmful to users. Sybil attack is one of serious threats that uses such vulnerability. In this paper, we propose a Sybil attack detection method and its response method to mitigate the effect of the attack in wireless network using ZigBee. The proposed method employs a challenge-response approach. A verifier send a node a request that corresponds to an identity, and the receiver should respond the request properly within threshold time. The performance of the proposed method is reasonable for applying it to the practical networks. This will help the wireless networks using ZigBee to enhance its security.