![](bg5.png)
Under assumptions previously stated, attacks can be classified into different kinds, so that
for all the attacks of kind
, the associated loss to any of them is a constant and all of them
rank between an interval
where is the most probable attack of kind and the least.
Then, we have the expected loss for attack kind
as
(13)
for
, where the total expected loss would be
(14)
Estimated costs for attack prevention, detection and response are much more easier to obtain
for whole attack kinds than for particular attacks [7]. Thus, if we define
as the cost associated
to prevention, detection and response to the
attack kind, where , then cost/benefit
analysis can be obtained from
and values using a methodology like the exposed in [12].
4 Conclusions and Future Work
We have presented some experimental evidence suggesting that intruders attacks follows a power
law distribution, very similar to the kind of distribution associated to several aspects of Internet
traffic.
We have shown how this power law distribution can be used to estimate expected losses for
diferent kind of attacks, assuming that the loss inflicted by one attack depends only on the kind
of attack and that attacks of the same kind are close-ranked. Further experimental evidence is
needed to verify how valid are these assumptions.
Further experimental study is also required to extend our analysis to virus and worms attacks.
References
1. R. J. Adler, R. E. Feldman and M. S. Taqqu (eds). A Practical Guide to Heavy Tails: Statis-
tical Techniques and Applications, Birkhauser, Boston, 1998.
2. R. G. Bace. Intrusion Detection, QUE, 1st Edition, December 1999.
3. L. Breslau, P. Cao, L. Fan, G. Phillips and S. Shenker. Web caching and Zipf-like distribu-
tions: evidence and implications. Proceedings of INFOCOMM’99, IEEE Press, 2000.
4. A. B. Downey. Evidence for long-tailed distributions in the Internet. ACM SIGCOMM Inter-
net Measurement Workshop, November 2001.
5. H. M. Edwards. Riemann’s Zeta Function. Dover Pubns, June 2001.
6. W. Lee, W. Fan, M. Miller, S.J. Stolfo and E. Zadok. Toward Cost-Sensitive Modeling for
Intrusion Detection and Response. Workshop on Intrusion Detection and Prevention, 7th
ACM Conference on Computer Security, Athens, November 2000.
7. U. Lindqvist and E. Jonsson. How to systematically classify computer security intrusions.
Proceedings of the IEEE Symposium on Research in Security and Privacy, Oakland CA,
May 1997.
8. S. Northcutt and J. Novak. Network Intrusion Detection, QUE, 3rd Edition, August 2002.
9. R.S. Pathak. Integral Transforms of Generalized Functions and Their Applications. Taylor
& Francis, December 1997.
10. T.R. Peltier. Information Security Risk Analysis, Auerbach Pub., 1st. edition, January 2001.
51