On the Effectiveness of Intrusion Response Systems against Persistent Threats

Persistent threats are the most sophisticated type of cyber attacks that involves multi-step attack sequences. There is a need to develop timely, efficient and appropriate intrusion response to mitigate the risk from persistent threats. In this paper, we model an intrusion response system by considering the diverse strategy an attacker could employ in his lateral movement within the target environment. Our model investigates attackers' opportunity corresponding to each strategy in their potential penetration path. We design a response mechanism by, first, analyzing prior steps of the attack sequence and their impacts, next, extracting attacker's characteristics from them, and finally, incorporating their influence on the next adversarial options, to efficiently restricts the follow up opportunities. The objective of our method is to deter attack occurrence by increasing the cost and uncertainty in attack planning and execution. Simultaneously, it is designed to ensure real-time situational awareness and operational efficiency. The proposed approach has been implemented with a case study on Industrial Control Systems. The empirical results show the significant improvement of impeding active threat propagation in the network.