Cost-based intelligent intrusion detection and response: design and implement

A flexible intrusion detection and response system (ID&R) needs to maximize security while minimizing cost and making response automatically. CI/sup 2/D&R, the cost-based intelligent intrusion detection and response system, is proposed, which is originally developed as a facility to deal with network-based attacks and to make effective response automatically and intelligently. The networking environment deployed with the CI/sup 2/D&R consists of two major parts: guard, which runs on the specific guarded host (GH), and spy, which runs in guarded network (GN). The components of the CI/sup 2/D&R are introduced, which include intrusion detection, attack classification, damage analysis, attack path rebuilding, resources automatically safeguarding, calamity recovery, and security officer. The several kinds of data flow in CI/sup 2/D&R are discussed, too. While CI/sup 2/&R is only a prototype, some experimental results are also presented.