Security Framework for Attack Detection in Computer Networks

Computer network security is concerned with
safeguards, responses and controls to prevent, react
and respond to attacks perceived on valued
information assets. Unfortunately, current technical
controls use by enterprises to protect their IT
investments are often stand-alone systems whose
independent protection are either isolated or
localised, and insufficient in adequately protecting
these assets. This book discusses an approach to
security defence that combines and integrates the
defences offered by stand-alone countermeasure
systems to adequately detect widespread attacks. An
integrated security framework is investigated that
is underpinned by sensor, analysis and response
defence paradigm. In the framework, sensors gather
pieces of attack evidence perceived on the entire
network and communicate their beliefs to the
analysis component. At the analysis component,
beliefs from sensors are correlated and combined to
detect and identify perceived attacks; while
responses are executed to mitigate the perceived
attacks. This book is intended for students,
researchers, security consultants, engineers,
administrators and analysts.

Auteur
Dr. Cyril Onwubiko is a Security Consultant at British Telecom (BT). Prior to BT, he spent eight years at COLT Telecom as a Network and Security Analyst, helping COLT develop its pan- European IP & MPLS VPN suite of services. Cyril's research interests are in Computer Network Security, Cyber Threat Analysis, SIEM, Graph Theory and Data Fusion.

Texte du rabat
Computer network security is concerned with safeguards, responses and controls to prevent, react and respond to attacks perceived on valued information assets. Unfortunately, current technical controls use by enterprises to protect their IT investments are often stand-alone systems whose independent protection are either isolated or localised, and insufficient in adequately protecting these assets. This book discusses an approach to security defence that combines and integrates the defences offered by stand-alone countermeasure systems to adequately detect widespread attacks. An integrated security framework is investigated that is underpinned by sensor, analysis and response defence paradigm. In the framework, sensors gather pieces of attack evidence perceived on the entire network and communicate their beliefs to the analysis component. At the analysis component, beliefs from sensors are correlated and combined to detect and identify perceived attacks; while responses are executed to mitigate the perceived attacks. This book is intended for students, researchers, security consultants, engineers, administrators and analysts.