Context aware intrusion response based on argumentation logic

Abstract

Automatic response in an intrusion detection process is a difficult problem. Indeed activating an inappropriate countermeasure for a given attack can have deleterious effects on the system which must be protected. In some cases the countermeasure can be more harmful than the attack it is targeted against. Moreover, given an attack against a specific system, the best countermeasure to apply depends on the context in which the system is operating. For example in the case of an automotive system, the fact that the vehicle is operating downtown or on a freeway changes the impact an attack may have on the system. This paper introduces a novel approach which uses an argumentative logic framework to reason and select the most appropriate countermeasure given an attack and its context.