Automated intrusion response system model based on danger theory - Ling-xi PENG; Dong-qing XIE; Ying-fang FU; Wei XIONG; Yu-li SHEN (Tongxin xuebao)
A novel automated response system model based on the danger theory (AIRSDT) was given.With the descriptions of self,non-self,immunocyte,memory detector,mature detector and immature detector of the network transactions,network danger evaluation equations for host and network were built up.Then,the automated response actions were taken or adjusted according to the danger of each network attack,including holistic risk degrees of the host and network.Both the theory analysis and experimental results prove that AIRSDT not only helps to solve the problem that the current automated response models could not detect the ‘true’ intrusion or attack action,but also greatly reduces the response times and response cost.