From Topological Vulnerability Analysis to Intrusion Management Systems

Intrusion Detection has been a body of research and development focusing on the development of techniques and products to block malicious activity. In parallel, automated vulnerability assessment tools have been proposed to provide a base ground for estimating the security level of a given infrastructure at a certain period of time. This paper explores the basic limitations of these two fundamental security techniques and proposes a complete framework for the development of Intrusion Management Systems (IMS) that exchange and correlate valuable information that complements and, in turn, leverages the effectiveness of both techniques. We also propose a revolutionary configuration approach that could assist in reducing Intrusion Detection false positives and Vulnerability Assessment false negatives and we finally describe the benefits that Intrusion Management Systems (IMS) could offer to post-security incident procedures, like Incident Response and Digital Forensics.