SPAR : an autonomous SDN intrusion response framework using combinatorial optimization over a probabilistic attack graph

Abstract

In a typical network, there is a multitude of critical assets that may be compromised by a malicious attacker through successive attacks. In this paper, we present SPAR ("Secure-Perceive-Adapt-Respond"), a framework which leverages Attack Graphs (AGs) and the manageability and malleability of Software-Defined Networking (SDN) to effectively reason about the security posture of the network. In the event of an intrusion, countermeasures are then selected using a combinatorial optimization model and effected to evolve the network to a more secure state, which could be effected automatically or raised as a suggestion to a human decision-maker in a semi-autonomous mode.