TELKOM
NIKA Indonesia
n
Journal of
Electrical En
gineering
Vol. 12, No. 8, August 201
4, pp. 6354 ~ 6360
DOI: 10.115
9
1
/telkomni
ka.
v
12i8.508
2
6354
Re
cei
v
ed
No
vem
ber 9, 20
13; Re
vised
April 1, 2014;
Accept
ed Ap
ril 15, 2014
A Dynamic Selection Algorithm on Optimal Auto-
Response for Network Survivability
Jinhui Zhao*
1,2
, Yuj
i
a Sun
1
, Liangxun Shuo
1
1
Net
w
o
r
k Infor
m
ation Sec
u
rit
y
L
abor
ator
y
S
h
iji
azh
uan
g Un
iversit
y
of Econ
omics,
No.13
6
, Hua
i
'
a
n East Road, S
h
iji
azh
uan
g, C
h
in
a, 031
1-87
2
075
77
2
School of Mec
han
ical El
ectro
n
ic an
d Information En
gi
neer
i
ng Ch
ina U
n
iv
ersit
y
of Min
i
n
g
and T
e
chnol
o
g
y
,
Beiji
ng,1
0
0
83, Chin
a, 18
630
1
296
15
*Corres
p
o
ndi
n
g
author, e-ma
i
l
: zhaoj
h9
977
@soh
u.com
1
, sun
y
u
jia
@sjzu
e
.edu.cn
2
,
shuo
lia
ng
xun
@
sjzue.
edu.cn
3
A
b
st
r
a
ct
In the selectio
n
process of survival st
rateg
i
es
, it is a challen
g
in
g w
o
rk to
a
u
tomatica
lly ch
oose th
e
opti
m
a
l
me
asu
r
e for the
survi
v
al ev
ent. A d
y
na
mic s
e
lecti
on a
l
g
o
rith
m is
prop
ose
d
, ba
sed o
n
fe
edb
a
c
k
control. Accor
d
ing to t
he fe
atu
r
e of surviv
al s
t
rategy,
the str
a
tegy
mo
de
l is
prese
n
ted, w
h
ich i
n
clu
des fu
or
specific attrib
u
t
e. T
he dyna
mic upd
at
e proc
ess of attribute vector is
de
scribe
d
in deta
il. Co
mbi
n
i
ng the
w
e
ight of pref
erenc
e an
d attributes
of strategy, the T
O
PSIS evalu
a
tio
n
is e
m
pl
oye
d
to select o
p
ti
mal
me
asur
e. Exp
e
ri
ments
an
d
ana
lysis sh
ow
that
opti
m
al
me
asur
e sel
e
cted by
prop
o
s
ed a
l
g
o
rith
m is
appr
opri
a
te an
d w
i
shful, w
h
ich
enric
hes the
researc
h
conte
n
t in this field.
Ke
y
w
ords
: n
e
tw
ork surviv
abil
i
ty, dyn
a
m
i
c
up
date,
active res
p
o
n
se,
T
O
PSIS (techni
que
for
or
der
prefere
n
ce by
similar
i
ty to ide
a
l sol
u
tion), ev
alu
a
tion
Copy
right
©
2014 In
stitu
t
e o
f
Ad
van
ced
En
g
i
n
eerin
g and
Scien
ce. All
rig
h
t
s reser
ve
d
.
1. Introduc
tion
After or when
survival in
cid
ents o
c
cur i
n
informatio
n system, auto-resp
on
se tech
nology
is to take a
serie
s
of me
asure
s
o
r
a
c
tio
n
s to
e
n
sure
the co
nfidenti
a
lity, integrity and avail
abil
i
ty
of
critical se
rvices. Co
hen
’s
[1] study, about
th
e
ca
pabilitie
s of
netwo
rk ma
n
ageme
n
ts, th
e
respon
se tim
e
and the
nu
mber of
su
ccessful defen
se, sho
w
n that
ti
mely resp
o
n
se i
s
e
s
senti
a
l in
preventin
g
su
rvival in
ciden
ts. In
reality,
becau
se th
e
cap
abilities o
f
admini
s
trato
r
s are
uneve
n
and the timeliness of the resp
on
se is di
fficul
t, timely
and re
asona
ble auto-re
sp
onse techn
o
l
ogy
is one of the important
means to im
prove the sy
stem vi
ability
.
How to
sel
e
ct em
ergency
measures an
d ho
w to
en
sure th
e effe
ct
iveness
of
th
e mea
s
u
r
e
s
i
s
key
step i
n
auto-re
sp
on
se
techn
o
logy.
There have been several
strategi
c ch
oice mo
del
s to achieve a quick and
timely
automatic
re
spon
se, whi
c
h
are mai
n
ly the followin
g
ca
tegorie
s:
Static Map
p
in
g Mod
e
l: Th
e
spe
c
ific type
of al
a
r
ms as
so
c
i
a
t
ed
w
i
th
th
e
s
p
ec
ific r
e
s
p
on
se
measures i
n
this mo
del.
When the
r
e a
r
e
alarm
s
, sp
e
c
ific re
spo
n
se
measures
are sel
e
cte
d
fro
m
respon
se
de
cision
table
according
to al
arm type. T
h
i
s
meth
od i
s
simple
to imp
l
ement, ea
sy
to
operate and
maintain, whi
c
h is a go
od solutio
n
to
the probl
ems of
timely respo
n
se, admi
n
ist
r
ator
cap
a
city an
d
so o
n
. But, this metho
d
did
not co
ns
i
der
the credibility
and
severity
of the attacks,
the su
rvival
con
d
ition of
attacked o
b
je
ct, and th
e resp
on
se m
e
asu
r
e
s
a
r
e e
a
sy to g
u
e
s
s by
attac
k
ers
.
It i
s
not s
u
itable for large-sc
ale s
y
s
t
ems
[2].
Dynami
c
Ma
pping Mo
del [3]: acco
rdin
g to the c
haracteristics of attack and sy
stem, this
model
sele
cts suita
b
le m
easure
s
to resp
on
se
the
attack. Because the mo
del co
nsi
ders the
variou
s
fa
ctors,
the re
spo
n
s
e strate
gie
s
are more
suit
able fo
r the
a
c
tual
situatio
n. Ho
weve
r, this
method i
s
le
ss
co
nsi
deration in the
ne
gative impa
ct
of re
spo
n
se; it is the lo
ss outwei
g
h
s
the
gain sometim
e
.
Co
st-sen
sitive Model: the goal of auto-resp
on
se is to
minimize the
cost in exch
ange for
maximum
se
curity. The
r
ef
ore, the
re
se
arche
r
s
prop
ose th
e cost
-sen
sitive mo
del by an
alyzing
the relation
ship betwe
en the pay and the benefit
of resp
on
se, and to sele
ct the appropri
a
te
respon
se
me
asu
r
e
s
, for e
x
ample reference
[4, 5]. This m
odel
can
en
sure that the cost
of
respon
se
is l
e
ss than
the l
o
ss of
surviv
al in
ci
dent. B
u
t there
are
many facto
r
s
in cal
c
ul
ated
the
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Dynam
ic S
e
lectio
n Algorithm
on Optim
a
l Au
to-Respon
se for Network…
(Ji
nhu
i Zhao)
6355
co
st of re
sp
o
n
se
and th
e
loss in
surviv
al inci
dent, a
nd ho
w to d
e
termin
e an
d
quantify the
s
e
factors i
s
a n
e
w
ch
allen
g
e
.
More
over, t
he
co
st of
re
spo
n
se i
s
u
n
certai
n. Som
e
time, the
co
st of
respon
se
is
high at th
e b
eginni
ng of
survival in
ci
de
nt, but the co
st is l
o
w fo
r t
he whole
eve
n
t.
Ho
w to
cal
c
ulate the
co
st of the
survival in
cid
ent
and
the
re
spo
n
se i
s
a
pro
b
lem
in
the
intera
ction p
r
oce
s
s.
Real
-time Intrusi
on Ri
sk Asse
ssme
nt Model
[6, 7]: this model
automaticall
y
select
respon
se
me
asu
r
e
s
a
c
co
rding to
the
ri
sk a
s
sess
me
nt of survival
inci
dent. It h
a
s
a g
ood
a
n
ti-
jamming
cap
ability, and synthetically consi
ders
the
perfo
rman
ce
and the ne
g
a
tive impact of
respon
se, wh
ich is the late
st model at prese
n
t.
The g
oal
of
automatical
resp
on
se i
s
t
o
ju
d
ge cu
rrent
survival si
tuation
by
survival
detectio
n
, ri
sk a
s
sessm
e
n
t, situational
awa
r
en
es
s, a
nd impl
ement
active
safeg
uard
procedu
re
s
according to the judge
ment
[8]. The content of
situational awa
r
e
n
e
s
s wa
s detaile
d in refere
nce
[9],
which didn’t
p
r
e
s
ent for spa
c
e. T
h
is wo
rk
fo
cus on strate
gy
sel
e
ctio
n,
whi
c
h
p
r
op
o
s
e a
dynamic
eval
uation and
selectio
n
m
e
thod of surviv
al
st
rategy
b
a
se
d o
n
dyn
a
mic up
date
of
attribute vect
or. And, the accura
cy of propo
sed meth
od is teste
d
b
y
simulated e
x
perime
n
t.
2. The Model
of D
y
namic
Strategic Selection
The mod
e
l of dynamic
strat
egic
sele
ction
is sho
w
n in F
i
gure 1.
Figure 1. The
Proce
s
s of Dynamic Strate
gic Sele
ction
In the mod
e
l
of dynami
c
strategi
c
sele
ction,
ma
nag
er of
strategi
es i
s
respon
sible fo
r
cla
ssifi
cation
and
storage
of strate
gie
s
, eval
uatio
n
and
choi
ce;
whe
n
survival events
ha
ve
detecte
d o
r
survivability n
eed
enh
an
ce
, the surviv
al
modul
e
sen
d
re
que
st a
n
d the
wei
ght
of
prefe
r
en
ce to
manag
er
of strategi
es; th
e mana
ge
r
of
strate
gies select the
stra
tegy in the set,
whi
c
h h
a
s th
e sa
me fun
c
t
i
on, acco
rdin
g to the p
r
ef
eren
ce
of user an
d the
attribute vect
ors of
strategy; the
manag
er
of strate
gie
s
adju
s
ts
we
ig
ht vector
of strate
gie
s
according to
the
feedba
ck inf
o
rmatio
n by
the feed
ba
ck mod
u
le. T
h
e core i
s
ho
w to
sele
ct the
right
su
rv
ival
strategi
es. T
he st
rategi
c
sele
ction
system, in su
rv
iv
al sy
st
em,
must
me
et
t
h
e t
i
meline
ss,
t
h
e
accuracy, the
rationality, self-
ada
ptive, se
curity and
so on.
Defin
e
1
: the set, in whi
c
h the strat
egie
s
hav
e the sam
e
function, is
descri
bed a
s
:
}
1
|
{
n
i
s
S
i
f
(1)
Whe
r
e n i
s
the numbe
r of strate
gies; ea
ch
i
s
has the same
function, b
u
t its
impleme
n
tation tech
niqu
e, operatin
g co
ndition
s and
so on may va
ry.
In orde
r to distingui
sh diff
erent st
rategi
es, we
de
scri
be in detail st
rategie
s
by attributes.
Acco
rdi
ng to the sp
eci
a
l re
quire
ment
s in
surviv
al syst
em, the attribute vector i
s
defined a
s
:
Defin
e
2
: the attribute vect
or of
i
s
at t mo
ment is
as
:
)}
(
),
(
),
(
),
(
{
)
(
)
(
)
(
)
(
)
(
)
(
t
A
t
A
t
A
t
A
t
A
i
c
i
t
i
e
i
a
i
(2)
Whe
n
the strategy (
i
s
) is se
lected at the moment (t),
the attribute vector i
s
ch
an
ge
d
according to the feedb
ack
)
(
t
t
M
i
.
t
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 8, August 2014: 635
4 –
6360
6356
))
(
),
(
(
)
(
)
(
)
(
t
t
M
t
A
f
t
t
A
i
i
i
(3)
The feedb
ack includ
es the
start time, the
end time, the survival state
s
, and so on.
Defin
e
3
:
Th
e vecto
r
of p
r
eferen
ce i
n
d
i
cate
s th
e
u
s
er'
s
p
r
efe
r
en
ce fo
r
prope
rties of
measures.
}
1
|
{
4
1
i
i
i
w
w
W
(4)
Whe
r
e
i
w
is the weig
ht of element in
)
(
)
(
t
A
i
.
Defin
e
4
:
According
to th
e vecto
r
of p
r
eferen
ce,
at t
he m
o
ment t
the sele
ction
pro
c
e
s
s
of optimal su
rvival stra
tegie
s
ca
n expre
s
s as:
)
(
}
,
,
2
,
1
|
)
),
(
{(
:
)
(
t
E
n
i
W
t
A
P
i
(5)
)
(
t
E
is the
comp
rehen
sive
eva
l
uation i
ndex
set
of
i
s
at the mom
ent t,
acco
rdin
g to
)
(
)
(
t
A
i
add
W
.
3. D
y
namic
Upda
te o
f
Attribute Vecto
r
3.1. Av
ailabilit
y
(
)
(
)
(
t
A
i
a
)
The avail
abl
e statu
s
of strategy
can
be a
c
q
u
ire
d
by feed
ba
ck and
monito
r. At the
moment t, the availability of
i
s
can estimate by the online proba
bility,
which can cal
c
ulate
as:
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
t
T
t
T
t
T
t
a
i
d
i
u
i
u
i
a
(6)
Whe
r
e:
)
(
)
(
t
T
i
u
is the sum
m
ation
of
i
s
available
time at perio
d
]
,
[
t
l
t
by the mom
ent t;
)
(
)
(
t
T
i
d
expresse
s th
e summ
ation
of
i
s
unusa
b
le time.
In orde
r to rapidly refle
c
t
the ch
angi
n
g
stat
e of m
easure
s
, we
join the d
e
te
ction of
adjacent stat
es in the calculat
ion of the online probability.
)
(
)
(
)
1
(
)
(
)
(
))
(
1
(
)
1
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
t
T
t
t
T
t
T
t
T
t
t
T
t
T
i
i
i
d
i
d
i
i
i
u
i
u
(7)
Whe
r
e
)
(
)
(
t
T
i
is the
differen
c
e
fo
r
compl
e
tion
of
appli
c
atio
n
or dete
c
tion
betwe
en t-1
and t.
)
(
)
(
t
i
is relat
ed to the re
su
lt of feedback and dete
c
tio
n
, which ca
n get by:
)
)
(
)
1
(
(
)
)
(
)
1
(
(
)
(
)
1
(
,
1
)
(
)
1
(
,
0
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
)
(
down
t
U
down
t
U
up
t
U
up
t
U
down
t
U
down
t
U
up
t
U
up
t
U
t
i
i
i
i
i
i
i
i
i
(8)
Whe
r
e
]
1
,
0
[
.
3.2. Effec
t
iv
e
n
ess (
)
(
)
(
t
A
i
e
)
The effective
ness of
i
s
at the moment t can pre
s
e
n
t as:
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Dynam
ic S
e
lectio
n Algorithm
on Optim
a
l Au
to-Respon
se for Network…
(Ji
nhu
i Zhao)
6357
)
(
)
(
1
)
(
)
(
)
(
)
(
t
N
t
N
t
a
i
i
f
i
e
(9)
W
h
er
e
)
(
)
(
t
N
i
indicates
i
s
’s frequ
ency
of u
s
e
in
]
,
[
t
l
t
by the time t;
)
(
)
(
t
N
i
f
expre
s
ses th
e freque
ncy without the d
e
sired re
sult. The value of
l
is obtained a
c
cordi
ng to the
i
s
’s intensive of use. When
l
is large e
n
o
ugh,
)
(
)
(
t
a
i
e
ca
n rep
r
ese
n
t the effectivene
ss of
i
s
at
the moment t+1.
3.3. Timeliness (
)
(
)
(
t
A
i
t
)
)
(
)
(
t
A
i
t
rep
r
e
s
ent
s th
e time inte
rva
l
of deali
ng
su
rvival event,
whi
c
h i
n
cl
ud
es
req
u
e
s
t of
use
r
, choi
ce
of strate
gy, e
x
ecution
and
taking
effe
c
t.
Some fac
t
ors affec
t
this
att
r
ibute,
s
u
c
h
as
band
width, transmi
ssion
rate, cong
esti
on, failure an
d so on.
)
(
)
1
(
)
1
(
)
(
)
(
)
(
)
(
t
T
a
t
a
a
t
a
i
i
t
i
t
(10)
Whe
r
e
)
(
)
(
t
T
i
is th
e
time for
execution of
i
s
, whi
c
h is empl
oye
d
or dete
c
ted
at mome
nt t;
a
is the wei
ghte
d
averag
e factor.
3.4. Cost
(
)
(
)
(
t
A
i
c
)
)
(
)
(
t
A
i
c
inclu
d
e
s
two
parts: n
egative impact an
d resou
r
ce co
n
s
ide
r
ation.
Ne
Ic
t
a
i
c
)
(
)
(
(11)
Whe
r
e
Ic
indica
tes the forecast for
con
s
u
m
e of differe
nt resou
r
ce;
Ne
is the valu
e o
f
negative imp
a
ct.
The valu
e of
Ic
is
confirmed
b
y
spe
c
iali
st, a
c
cordi
ng to
service
conditi
on a
nd
rep
o
si
tory.
Ne
can cal
c
ulate by:
T
t
T
S
P
Ne
i
t
)
(
)
(
(12)
Whe
r
e P pre
s
ent
s the value of sou
r
ce;
t
S
express the intensi
on, whi
c
h is cl
asse
d
three
or more different grad
es le
vels
and ma
p
into interval [0, 1];
)
(
)
(
t
T
i
means the executio
n time of
measure;
T
pre
s
ent the time
perio
d, whi
c
h
was u
s
e
d
in asse
ssm
ent asset.
4. The D
y
namic Selected
Process o
f
Sur
v
iv
al Strategic
Acco
rdi
ng to the description of define
4, we sel
e
ct
optimal stra
tegy by
TOPSIS(Techniqu
e fo
r O
r
de
r Prefere
n
ce
by Simil
a
rity to a
n
I
deal S
o
lution
), the
step
s
are
following:
1) It is need t
o
establi
s
h d
e
ci
sion mat
r
ix of attributes.
)
(
)
(
)
(
)
(
)
(
)
(
)
1
(
)
1
(
t
a
t
a
t
a
t
a
X
n
c
n
a
c
a
(13)
Whe
r
e n is th
e numbe
r of measures, which h
a
ve the
same fun
c
tio
n
.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 8, August 2014: 635
4 –
6360
6358
2)
T
h
e
r
e are
co
st
ind
e
xes and pe
rforma
nce
ind
e
xes. The co
st
in
de
xes
a
r
e
a
s
small
a
s
possibl
e, whil
e perfo
rma
n
ce indexe
s
a
r
e the big
ger t
he better; the
dimen
s
ion
s
are diffe
rent f
o
r
each index. For ea
se of co
mpari
s
o
n
, ind
e
xes are no
rmalize
d
by followin
g
:
)
(
)
(
/
)
(
)
(
)
(
/
)
(
)
(
min
)
(
max
)
(
)
(
Cost
t
a
t
a
r
e
Performanc
t
a
t
a
r
i
i
j
ij
i
i
j
ij
(14)
3) The
weig
hted normali
ze
d matrix is ob
tained by W a
nd X.
)
(
)
(
ij
j
ij
r
w
y
Y
(15)
4) Acco
rdin
g
to the matri
x
of Y,
the opt
imal and
worst d
e
ci
sio
n
scheme
s
a
r
e bro
ught
out.
}
,
,
{
)}
,
,
{min(
}
,
,
{
)}
,
,
{max(
min
min
1
1
max
max
1
1
n
in
i
n
in
i
y
y
y
y
A
y
y
y
y
A
(16)
5) The di
stan
ce of ea
ch st
rategy to
A
and
A
is cal
c
ul
ated.
2
/
1
4
1
2
min
2
/
1
4
1
2
max
]
)
(
[
]
)
(
[
j
j
ij
i
j
j
ij
i
y
y
D
y
y
D
(17)
6) To buil
d
the comp
re
hen
sive evaluatio
n
index set, a
nd sel
e
ct opti
m
al strate
gy.
i
i
i
i
i
D
D
D
t
e
t
e
t
E
)
(
|
)
(
)
(
(18)
5. Experiments
In orde
r to te
st the effectiv
ene
ss
of this
model, the e
x
perime
n
tal e
n
vironm
ent is putted
up. The
topol
ogical
stru
ctu
r
e
sho
w
s a
s
Figure 2. If
a
n
intru
d
e
r
wa
nts to
attack t
he n
ode
s in
the
inner net
work from Inte
rnet
, the fire
wall i
s
the fi
rst p
r
o
t
ective ba
rrie
r
. A swit
chb
o
a
r
d
con
n
e
c
ts a
ll
the se
rvers a
nd PC. The
super i
n
tru
s
ion
detection
sy
stem (SIDS
)
i
s
the second
shiel
d
ing, whi
c
h
monitor the
survival events and
se
le
ct automatic
re
spo
n
se mea
s
ure
s
. The
r
e
are mo
nitors in
each se
rver,
whi
c
h dete
c
t the servi
c
e fa
ilure
s or
the result
s of resp
onse and
se
nd the state to
the SIDS.
Figure 2. The
Netwo
r
k Env
i
ronm
ent of Experime
n
t
Evaluation Warning : The document was created with Spire.PDF for Python.
TELKOM
NIKA
ISSN:
2302-4
046
A Dynam
ic S
e
lectio
n Algorithm
on Optim
a
l Au
to-Respon
se for Network…
(Ji
nhu
i Zhao)
6359
Attack cla
s
sification i
s
the base of strate
gy c
hoi
ce, wh
ich is divide
d into two cate
gorie
s:
failure eve
n
ts, security eve
n
ts. Prog
re
ssive fa
ilure
s a
nd unexp
e
cte
d
accide
nts a
r
e taken a
s
o
n
e
cla
ss, an
d take co
rre
sp
ondi
ng re
spo
n
se
measures
. B
a
se
d on the a
ttack cl
assification method
of
MIT Lin
c
oln
laboratory, there
are fou
r
majo
r
type
s atta
cks: Probe
s,
R2
L, U2
R
an
d Do
S.
Acco
rdi
ngly, automatic
respon
se
strate
g
i
es
are
divide
d into
re
cord, analy
s
is, al
a
r
ming,
ba
cku
p
,
refuse,
isolati
on,
beat ba
ck
an
d can
c
el
.
Each re
spo
n
se strategy inclu
d
e
s
several
m
e
a
s
u
r
e
s
.
Acco
rdi
ng to above, the SIDS sele
cts
re
spo
n
se
meth
od, whe
n
su
rvival event ta
ke pla
c
e.
Acco
rdi
ng to
the situation
awa
r
en
ess,
the SI
DS sel
e
ct the a
ppli
c
ation
strate
gies. In
orde
r to a
nal
yze the p
r
o
c
ess of choi
ce
, we
si
mulate
the offensiv
e and
defen
sive behavio
r
for
four h
ours. In
the first hou
r, there a
r
e o
n
ly ma
lici
o
u
s
attacks,
whi
h
have l
o
w f
r
eque
ncy; in t
he
se
con
d
hou
r,
the frequ
en
cy of maliciou
s
attacks
i
s
hig
h
, and the m
a
licio
us atta
cks i
n
clu
de
so
me
more
ha
rmful
;
there
are
m
a
licio
us
attacks with fa
il
ure of servi
c
e i
n
the thi
r
d h
o
u
r; some
se
rvice
cra
s
h
e
in the fourth hou
r. T
he Table 1
sh
ows the sp
eci
f
ic.
Table 1. Surv
ival Events
and Re
sp
on
se
Strategies
Time
Position
T
y
pe
of Th
reat
Strateg
y
Descript
i
on
1
0:03
Route
Portsweep scan
Checked out
2
0:07
Server
Satan scan
Checked out
3 0:15
Mail
Trojan
Checked
out
4 0:23
PC
Trojan
Authentication
Filter
5
0:29
WEB
Apache mod_ssl buffer overflo
w
IP Access Restrictions
6
0:31
Route
Worms
Successful survival
7 0:36
WEB
Worms
Tolerance
……
……
……
……
……
……
53 3:43
WEB
DOS
Shutdo
w
n
54 3:47 Database
Heap-based
buff
e
r
overflo
w
Patch
55 3:50 Database
failure
Sw
itch
to
Backup
Acco
rdi
ng to
different fun
c
tion, ea
ch n
ode ha
s diffe
rent survival purp
o
ses, so
it has
distin
ct prefe
r
ence of re
sp
onse
strategy
. For exampl
e, the serv
i
c
e of Web fo
cus on
providi
ng
informatio
n, the attrib
ute o
f
co
st is mo
re
impo
rtant
in
its choi
ce of
strategy; b
e
cause in th
e fil
e
s
servi
c
e,
confi
dentiality is
most im
porta
nt, the effe
cti
v
eness i
s
a
p
r
iority. In o
r
d
e
r to
provide
the
contin
uou
s service,
the server
of data
base de
sign
dual hot
st
andby,but th
e initial valu
e of
negative imp
a
ct is hig
h
. In the experime
n
t, the
preference wei
ght vectors a
r
e a
s
Table 2.
Table 2. Pref
eren
ce
Weig
ht Vectors
Server
Availability
Effe
ctiveness Timeliness
Cost
Web 0.3
0.1
0.1
0.5
Files 0.3
0.3
0.3
0.1
Database
0.2
0.3
0.2
0.3
Mail 0.2
0.3
0.2
0.3
PC 0.25
0.25
0.25
0.25
At the moment
t
, the op
timal measu
r
e (
i
s
) is empl
oyed, the attribute
s
of
i
s
are
adju
s
ted
accordin
g to fe
e
dba
ck
)
1
(
t
M
i
at the
moment
1
t
. Th
e up
date m
e
thod i
s
as the
above.
The l
a
st
ro
w i
n
Ta
ble
1
sho
w
n th
e
re
spo
n
se
meth
od
s
in the
expe
ri
ment. As sho
w
n,
web
serve
r
usuall
y
adopt
the
method
of tol
e
ran
c
e,
be
ca
use
the
weig
ht of
co
st is
high,
whi
c
h
h
a
s
more
attentio
n on
the i
m
pa
ct of
su
rvial e
v
ent; only wh
en the
attack
of DOS
lea
d
e
d
to failu
re, th
e
web
se
rver restarte
d. the
rest
ricte
d
a
c
cess for
IP of
attacker
ha
s
high frequ
ency in files
se
rve
r
for its effecti
v
eness
and
timeline
ss.
Databa
se
pref
er to
delete
the suspici
o
u
s
u
s
e
r
, an
d t
he
serve
r
woul
d
swit
ch to b
a
ckup
wh
en the
r
e i
s
a
critical
fault. Prese
n
t
ed app
roa
c
h
e
not only ta
kes
into the cost
of the re
sp
on
se, but
also
consi
der
t
he ot
her
pro
pertie
s
an
d dyna
mi
c p
r
op
ertie
s
. the
rationality an
d accuracy
of presented
appro
a
che
s
is significan
t
ly better than the traditio
nal
method
s. Experime
n
ts al
so
verify the results.
Evaluation Warning : The document was created with Spire.PDF for Python.
ISSN: 23
02-4
046
TELKOM
NI
KA
Vol. 12, No. 8, August 2014: 635
4 –
6360
6360
4. Conclusio
n
Survival situ
a
t
ional a
w
a
r
en
ess i
s
the
b
a
s
e
of a
u
toma
tic respon
se;
automatic respon
se
is the import
ant method to improve th
e viability of
system.
Strategy
choi
ce
is the key step
in
utomatic respon
se.
Thi
s
pape
r
fou
cs on
sel
e
ctio
n
of optimal st
rategy for th
e sam
e
survi
v
al
event, accord
ing to non
-fun
ctional p
r
o
perty. The st
ruct
ure of st
rateg
y
eval
uation i
s
given, ba
se
d
on
dyna
mic update Qo
s of
su
rvival
strategy, whi
c
h
elabo
rated
th
e dynami
c
u
pdate p
r
o
c
e
s
s of
attributes vector ba
sed
on
informatio
n fe
edba
ck
an
d p
r
ocess of
assessment b
a
sed on
TOPSIS
algorith
m
. Experim
ents in
dicate that selecte
d
re
sul
t
s were app
ropriate a
nd
desi
r
ed, an
d
the
prop
osed alg
o
rithm was
suitable for the
real network
environ
ment.
Ackn
o
w
l
e
dg
ements
The autho
rs woul
d like to ackno
w
le
dge
shijiazhua
ng
university of eco
nomi
cs in
suppo
rt
with the initial fund of scie
n
tific resea
r
ch afte
r our d
o
ctorate and
Heb
e
i provin
ce’
s
scien
c
e
an
d
techn
o
logy pl
an proj
ect (13
2107
02
D).
Referen
ces
[1]
Cohen
F.Simu
lating Cy
ber Attacks
，
Defenses and C
onsequenees. http://a
ll.net/joumal/ntb/
simulat
e
/simul
ate.html, 199
9-
3/200
9-3.
[2]
T
homas T
o
th, Christo
p
h
e
r
Krueg
el.
Eva
l
uatin
g th
e i
m
pact of
auto
m
ate
d
intrusi
o
n res
pons
e
mec
h
a
n
is
ms
. Porc of the 18
th
Annual Com
puter Secur
i
t
y
Applic
ation C
onfere
n
ce W
a
shin
gton DC
.
IEEE Compute
r
Societ
y
.
2
0
0
2
:
301-31
0.
[3]
CA C
a
rve, U
pooc
h.
A M
e
thod
olo
g
y for
Using
In
te
ll
ig
en
t Ag
ent to Provide Aut
o
mated Intrusion
Resp
onse. Ne
w
York:
IEEE
S
y
setms
，
Ma
n and C
y
b
e
m
e
tics Inofmrati
on Assura
nce
and Secur
i
y
t
W
o
rkshop. W
e
st Point. 2000;
163-
175
．
[4]
GUO Yu, SUN. Intrusion
resp
onse
bas
ed
on
SVM co
st-sen
sitive d
e
cisi
on
mode
l. 20
07: 2
7
(11):
270
4
-
270
6.
[5]
W
u
Hon
g
run,
Qin Jun, Z
h
en
g Boj
i
n. Anti-
a
ttack
Abil
it
y
B
a
sed o
n
C
o
sts i
n
Com
p
le
x
Net
w
o
r
ks. 20
12;
39(8): 22
4-2
2
7
,
255.
[6]
Hu He, Hu C
han
gzh
en, Ya
o Shup
in
g. De
cision
on Opti
mal Active Re
spons
e Base
d
on Intrusio
n
Graph.
Journ
a
l
of Beijin
g Univ
ersity of Techn
o
lo
gy
. 201
2; 38(11): 16
59-
16
64
．
[7]
W
u
W
en, Meng
Xi
an
gru Ma Z
h
iqi
a
n
g
, Ch
en
Duol
on
g. Net
w
ork Sruviva
b
i
lit
y Situ
atio
n T
r
acking B
a
sed
on Mod
u
lar
i
a
e
d
D
y
nam
ic Game.
Journa
l of XIAN Jiaoton
g
Univers
i
ty
. 201
2; 46(12):
y1-
y
6
．
[8]
Z
hang
Yo
ngzh
eng, F
a
ng
Bi
n
x
i
ng,
Chi
Yu
e,
etal.
Risk
pr
opa
gati
on m
o
del
for
assess
ing
net
w
o
rk
informati
on s
y
s
t
ems.
Journal of
Softw
are
. 2007; 18(1): 1
37-
145.
[9]
Zhao Jin
h
u
i
, Zhou Yu, Sh
uo
Lia
n
g
x
u
n
. A Situatio
n A
w
ar
en
ess Mode
l of System Surv
iva
b
ilit
y Bas
ed o
n
Variable Fuzz
y Set.
T
E
LKOM
NIKA Indo
nes
i
an J
our
nal
of
Electrical
En
gi
neer
ing
.
20
12;
10(
8): 1
701-
170
8.
[10]
Z
hao J
i
nh
ui,
W
ang
Xueh
ui,
Xu Qia
n
. V
a
ria
b
le
W
e
ig
h
t
s in Assess
ment of S
u
rvi
v
al S
y
stem.
T
E
LKOMNIKA Indon
esi
an Jou
r
nal of Electric
al Eng
i
ne
eri
n
g
.
2013; 1
1
(5): 2
284-
229
0.
[11]
Lin
W
ang
qu
n, W
ang
H
u
i, L
i
u
Ji
aho
ng, et al.
R
e
searc
h
on active
def
e
n
se
tec
h
n
o
lo
g
y
in
n
e
t
w
ork
securit
y
bas
ed
on non-c
o
o
p
e
rative d
y
n
a
m
i
c game the
o
r
y
.
Journ
a
l of
Co
mp
uter Res
earch a
nd
Devel
o
p
m
en
t. 201
1; 48(2): 30
6-31
0.
Evaluation Warning : The document was created with Spire.PDF for Python.