Performance, Computing, and Communications Conference, 2002. 21st IEEE International (2006)
Phoenix, AZ, USA
Apr. 10, 2006 to Apr. 12, 2006
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/.2006.1629458
null Madhusudhanan Chandrasekaran , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
null Mukkarram Baig , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
null Shambhu Upadhyaya , Dept. of Comput. Sci.&Eng., State Univ. of New York, USA
In this paper we propose an automated approach for determining recently published vulnerabilities pertinent to the current network/system configuration using the information aggregated from different bug tracking communities. Such vulnerability assessment and indication mechanisms significantly alleviate the system administrator's burden of manual content digging for vulnerabilities in his/her own configuration context. Furthermore, we propose an extensible defense oriented representation schema (EDORS) for vulnerability representation, which is consequently used by the policy engine to generate appropriate IDS signatures. As a result, the generated signatures can be viewed as a preventive stop-gap security measure against zero-day exploits until its patch is released. In the absence of precise detection signatures, we extend our framework to perform forensic analysis on the alerts generated, by constructing Bayesian causality graphs to assess the impact and extent of the attack. The preliminary experiments carried out suggest that our approach is able to analyze the system/network for even the most recent zero-day vulnerabilities and generate their corresponding signatures with very minimal performance and administrative overhead.
Bayesian causality graph, automated approach, AVARE, aggregated vulnerability assessment, indication mechanism, system administrator, extensible defense oriented representation schema, EDORS, policy engine, IDS signature, stop-gap security, forensic analysis
n. Mukkarram Baig, n. Shambhu Upadhyaya and n. Madhusudhanan Chandrasekaran, "AVARE: aggregated vulnerability assessment and response against zero-day exploits," Performance, Computing, and Communications Conference, 2002. 21st IEEE International(PCC), Phoenix, AZ, USA, 2006, pp. 80.