Security Framework for Attack Detection in Computer Networks

Computer network security is concerned with safeguards, responses and controls to prevent, react and respond to attacks perceived on valued information assets. Unfortunately, current technical controls use by enterprises to protect their IT investments are often stand-alone systems whose independent protection are either isolated or localised, and insufficient in adequately protecting these assets. This book discusses an approach to security defence that combines and integrates the defences offered by stand-alone countermeasure systems to adequately detect widespread attacks. An integrated security framework is investigated that is underpinned by sensor, analysis and response defence paradigm. In the framework, sensors gather pieces of attack evidence perceived on the entire network and communicate their beliefs to the analysis component. At the analysis component, beliefs from sensors are correlated and combined to detect and identify perceived attacks; while responses are executed to mitigate the perceived attacks. This book is intended for students, researchers, security consultants, engineers, administrators and analysts.

Dr. Cyril Onwubiko is a Security Consultant at British Telecom (BT). Prior to BT, he spent eight years at COLT Telecom as a Network and Security Analyst, helping COLT develop its pan- European IP & MPLS VPN suite of services. Cyril¿s research interests are in Computer Network Security, Cyber Threat Analysis, SIEM, Graph Theory and Data Fusion.