The Community for Technology Leaders
Performance, Computing, and Communications Conference, 2002. 21st IEEE International (2006)
Phoenix, AZ, USA
Apr. 10, 2006 to Apr. 12, 2006
ISBN: 1-4244-0198-4
pp: 80
null Madhusudhanan Chandrasekaran , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
null Mukkarram Baig , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
null Shambhu Upadhyaya , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
ABSTRACT
In this paper we propose an automated approach for determining recently published vulnerabilities pertinent to the current network/system configuration using the information aggregated from different bug tracking communities. Such vulnerability assessment and indication mechanisms significantly alleviate the system administrator's burden of manual content digging for vulnerabilities in his/her own configuration context. Furthermore, we propose an extensible defense oriented representation schema (EDORS) for vulnerability representation, which is consequently used by the policy engine to generate appropriate IDS signatures. As a result, the generated signatures can be viewed as a preventive stop-gap security measure against zero-day exploits until its patch is released. In the absence of precise detection signatures, we extend our framework to perform forensic analysis on the alerts generated, by constructing Bayesian causality graphs to assess the impact and extent of the attack. The preliminary experiments carried out suggest that our approach is able to analyze the system/network for even the most recent zero-day vulnerabilities and generate their corresponding signatures with very minimal performance and administrative overhead.
INDEX TERMS
Bayesian causality graph, automated approach, AVARE, aggregated vulnerability assessment, indication mechanism, system administrator, extensible defense oriented representation schema, EDORS, policy engine, IDS signature, stop-gap security, forensic analysis
CITATION
null Madhusudhanan Chandrasekaran, null Mukkarram Baig, null Shambhu Upadhyaya, "AVARE: aggregated vulnerability assessment and response against zero-day exploits", Performance, Computing, and Communications Conference, 2002. 21st IEEE International, vol. 00, no. , pp. 80, 2006, doi:10.1109/.2006.1629458
91 ms
(Ver 3.3 (11022016))