Enhancing Graph-based Automated DoS Attack Response

‘GrADAR’ is an intuitive approach to create and maintain a model of a computer network and of the availability of its resources from the observations of deployed monitoring systems [JTM07, JTM08]. The graph-based model is able to express both the effects of DoS attacks and characterise the result of available response measures prior to their application in the real-world network. Thus, the approach provides a methodology for automatically selecting response measures to detected attacks. The most appropriate response is chosen based on metrics which are well-known from the pragmatic view of network security officers. This contribution proposes an extension to our previous GrADAR approach that seeks to incorporate the effects of network and resource workload into the availability estimation. This should permit a more detailed modelling of the current network state and the effects of applied countermeasures to detected DoS attacks.