Automated intrusion response systems

These systems seek to evaluate information available to them at the time of attack detection, and subsequently determine and deploy the optimal response. Previous research proposes systems which are generally too static in both their understanding of a defended network, and in their response capability.

This leads to difficulty when handling today’s dynamic networks and the ever-evolving threat landscape. The work in this thesis investigates the application of emerging technologies and proposes new frameworks to develop more dynamic automated Intrusion Response Systems, which are less reliant on pre-defined network security models, can respond to attacker tactics outlined in MITRE’s ATT&CK, and more closely integrate with user-defined security policies.