Security Framework for Attack Detection in Computer Networks

Computer network security is concerned with §safeguards, responses and controls to prevent, react §and respond to attacks perceived on valued §information assets. Unfortunately, current technical §controls use by enterprises to protect their IT §investments are often stand-alone systems whose §independent protection are either isolated or §localised, and insufficient in adequately protecting §these assets. This book discusses an approach to §security defence that combines and integrates the §defences offered by stand-alone countermeasure §systems to adequately detect widespread attacks. An §integrated security framework is investigated that §is underpinned by sensor, analysis and response §defence paradigm. In the framework, sensors gather §pieces of attack evidence perceived on the entire §network and communicate their beliefs to the §analysis component. At the analysis component, §beliefs from sensors are correlated and combined to §detect and identify perceived attacks; while §responses are executed to mitigate the perceived §attacks. This book is intended for students, §researchers, security consultants, engineers, §administrators and analysts.