Policy-based intrusion detection and automated response mechanism

Abstract

Automated response to intrusions has become a major issue in defending critical systems. Because the adversary can take actions at computer speeds, systems need the capability to react without human intervention. Policybased network simplifies the many tasks associated with coordinating the resources and capabilities of the network with the business-level goals of the network administrator. This paper provides policy-based security management architecture enabling network-wide intrusion detection and automated response. And this paper provides required functionality to realize the automated response mechanism. This paper also presents security policies to facilitate security management functions in policy-based networks.