Computer network intrusion detection, assessment and prevention based on security dependency relation

An approach to detection, assessment and prevention of further intrusions of distributed intrusions in a computer network is presented. Our approach uses audit data from multiple network nodes and services. To achieve accurate results, inherent security relations among different network nodes should be considered. In our approach, the security dependency relation (SDR) is defined to describe these relations, and ripple effect analysis is used to detect, assess, and prevent intrusions based on SDRs. Agents are used to improve the scalability and efficiency of our approach.