A Countermeasure Recommendation System against Targeted Attacks with Preserving Continuity of Internal Networks

Recently, the sophistication of targeted cyber attacks makes conventional countermeasures useless to defend our network. Proper network design, i.e., Moderate segmentation and adequate access control, is one of the most effective countermeasures to prevent stealth activities of the attacks inside the network. By paying attention to the violation of the control, we can be aware of the existence of the attacks. In case that suspicious activities are found, we should adopt more strict design for further analysis and mitigation of damage. However, an organization must assume that its network administrators have full knowledge of its business and enough information of its network structure for selecting the most suitable design. This paper discusses a recommendation system to enhance the ability of a semi-automatic network design system previously proposed by us. Our new system evaluates on the viewpoint of two criteria, the effectiveness against malicious activities and the impact on business. The former takes the infection probability and hazardousness of communication into account and the latter considers the impact of the countermeasure which affects the organization's activities. By reviewing the candidate of the countermeasures with these criteria, the most suitable one to the organization can be selected.

I. Introduction

Recent cyber attacks have been so sophisticated that conventional countermeasures cannot defend our networks against them. The most of the countermeasures are designed under the assumption that we can know the detail of the attacks in advance. For example, mass infection of malwares makes us possible to collect and analyze their samples to describe their features. Although we have to accept the existence of several victims, detection patterns for anti-virus and signatures for intrusion detection can be prepared as inbound countermeasures.