{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,4]],"date-time":"2026-03-04T17:21:15Z","timestamp":1772644875801,"version":"3.50.1"},"reference-count":47,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2018,3,31]],"date-time":"2018-03-31T00:00:00Z","timestamp":1522454400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Pacific Northwest National Laboratory under U.S. Department of Energy","award":["DE-AC05-76RL01830"],"award-info":[{"award-number":["DE-AC05-76RL01830"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Auton. Adapt. Syst."],"published-print":{"date-parts":[[2018,3,31]]},"abstract":"<jats:p>The continuous increase in the quantity and sophistication of cyberattacks is making it more difficult and error prone for system administrators to handle the alerts generated by intrusion detection systems (IDSs). To deal with this problem, several intrusion response systems (IRSs) have been proposed lately. IRSs extend the IDSs by providing an automatic response to the detected attack. Such a response is usually selected either with a static attack-response mapping or by quantitatively evaluating all available responses, given a set of predefined criteria. In this article, we introduce a probabilistic model-based IRS built on the Markov decision process (MDP) framework. In contrast to most existing approaches to intrusion response, the proposed IRS effectively captures the dynamics of both the defended system and the attacker and is able to compose atomic response actions to plan optimal multiobjective long-term response policies to protect the system. We evaluate the effectiveness of the proposed IRS by showing that long-term response planning always outperforms short-term planning, and we conduct a thorough performance assessment to show that the proposed IRS can be adopted to protect large distributed systems at runtime.<\/jats:p>","DOI":"10.1145\/3168446","type":"journal-article","created":{"date-parts":[[2018,4,16]],"date-time":"2018-04-16T12:27:57Z","timestamp":1523881677000},"page":"1-23","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":25,"title":["Model-Based Response Planning Strategies for Autonomic Intrusion Protection"],"prefix":"10.1145","volume":"13","author":[{"given":"Stefano","family":"Iannucci","sequence":"first","affiliation":[{"name":"Mississippi State University, Mississippi State, MS"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sherif","family":"Abdelwahed","sequence":"additional","affiliation":[{"name":"Virginia Commonwealth University, Richmond, VA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2018,4,16]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2009.04.090402"},{"key":"e_1_2_1_2_1","unstructured":"Akamai. 2015. Akamai\u2019s State of the Internet: Q3 2015 Report. Retrieved March 2 2018 from https:\/\/www.stateoftheinternet.com\/resources-cloud-security-2015-q3-web-security-report.html.  Akamai. 2015. Akamai\u2019s State of the Internet: Q3 2015 Report. Retrieved March 2 2018 from https:\/\/www.stateoftheinternet.com\/resources-cloud-security-2015-q3-web-security-report.html."},{"key":"e_1_2_1_3_1","unstructured":"R. E. Bellman. 1957. Dynamic Programming. Princeton University Press Princeton NJ.   R. E. Bellman. 1957. Dynamic Programming. Princeton University Press Princeton NJ."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1561\/2200000006"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.5555\/1029693.1029710"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2007.913919"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2011.68"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2014.2349899"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2013.72"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.8"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390187"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568088.2576799"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.5555\/2016945.2016946"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2015.2418736"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2014.02.139"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2005.17"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/IranianCEE.2016.7585693"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10586-006-4893-0"},{"key":"e_1_2_1_20_1","doi-asserted-by":"crossref","unstructured":"C. L. Hwang and K. Yoon. 1981. Multiple Criteria Decision Making. Lecture Notes in Economics and Mathematical Systems. Springer.  C. L. Hwang and K. Yoon. 1981. Multiple Criteria Decision Making. Lecture Notes in Economics and Mathematical Systems. Springer.","DOI":"10.1007\/978-3-642-48318-9"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICAC.2016.12"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICAC.2016.11"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2016.7568529"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2015.12.006"},{"key":"e_1_2_1_25_1","unstructured":"Finn V. Jensen. 1996. An Introduction to Bayesian Networks. Vol. 210. UCL Press London England.   Finn V. Jensen. 1996. An Introduction to Bayesian Networks. Vol. 210. UCL Press London England."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.5555\/1622737.1622748"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1017932429737"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2003.1160055"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/11871842_29"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/597917.597919"},{"key":"e_1_2_1_31_1","volume-title":"Technical Report DCS-TR-631. Rutgers University.","author":"Li L.","year":"2008"},{"key":"e_1_2_1_32_1","unstructured":"Carlos Joshua Marquez. 2010. An Analysis of the IDS Penetration Tool: Metasploit. Retrieved March 2 2018 from https:\/\/www.infosecwriters.com\/text_resources\/pdf\/jmarquez_Metasploit.pdf.  Carlos Joshua Marquez. 2010. An Analysis of the IDS Penetration Tool: Metasploit. Retrieved March 2 2018 from https:\/\/www.infosecwriters.com\/text_resources\/pdf\/jmarquez_Metasploit.pdf."},{"key":"e_1_2_1_33_1","unstructured":"Peter Mell Karen Scarfone and Sasha Romanosky. 2007. A Complete Guide to the Common Vulnerability Scoring System: Version 2.0. Retrieved March 2 2018 from https:\/\/www.first.org\/cvss\/v2\/guide.  Peter Mell Karen Scarfone and Sasha Romanosky. 2007. A Complete Guide to the Common Vulnerability Scoring System: Version 2.0. Retrieved March 2 2018 from https:\/\/www.first.org\/cvss\/v2\/guide."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIC.2002.1067740"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2808475.2808482"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2009.07.079"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/IMF.2015.13"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.24.11.1127"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.5555\/1039834.1039864"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1975.9939"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2015.05.004"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2007.9"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87403-4_21"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.5555\/784592.784788"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/2555611"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSTE.2010.5608747"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2013.211"}],"container-title":["ACM Transactions on Autonomous and Adaptive Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3168446","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3168446","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:30:33Z","timestamp":1750217433000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3168446"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,3,31]]},"references-count":47,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2018,3,31]]}},"alternative-id":["10.1145\/3168446"],"URL":"https:\/\/doi.org\/10.1145\/3168446","relation":{},"ISSN":["1556-4665","1556-4703"],"issn-type":[{"value":"1556-4665","type":"print"},{"value":"1556-4703","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,3,31]]},"assertion":[{"value":"2016-09-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2017-11-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-04-16","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}