1 A Methodology for Using Intelligent Agents to provide Automated Intrusion Response

Abstract--This paper proposes a new methodology for adaptive, automated intrusion response (IR) using software agents. The majority of intrusion response systems (IRSs) react to attacks by generating reports or alarms. This introduces a window of vulnerability between when an intrusion is detected and when action is taken to defend against the attack. Research by Cohen indicates that the success of an attack is dependent on the time gap between detection and response. If skilled attackers are given ten hours after they are detected and before a response, they will be successful 80 % of the time. At thirty hours, the attacker almost never fails [1]. The proposed methodology addresses this window of vulnerability by providing an automated response to incidents using a heterogeneous collection of software agents. These agents collaborate to protect the computer system against attack and adapt their response tactics until the system administrator can take an active role in the defense of the system. Index Terms – Intrusion Response, computer security, intelligent agent