![](bg7.png)
2. After completing all required Self-Healing opera-
tions, the mitigation rule is remotely applied on
the virtual machine. Furthermore, Self-Healing
composes a human-readable mitigation which is
displayed to the user.
3. The Rule Applicator subcomponent of the Self-
Healing enriches the STIX package with a Course
of Action SDO which contains information about
the mitigation rule that was generated by the Self-
Healing component.
...
{
"type":"course-of-action",
"id":"course-of-action--8e2e2d2b-17d4
-4cbf-938f-98ee46b3cd3f",
"created":"2016-08-31T11:37:49.307Z",
"modified":"2016-08-31T11:37:49.307Z
",
"name":"mitigation",
"description":"iptables -A CSAWARE-IN
-s 123.183.209.131 -j REJECT"
}
4. The CSAWARE-IN chain now contains the miti-
gation rule that was generated by the Self-Healing
component.
6 CONCLUSIONS
The extensive exposure of organisations to existing
and emerging cyberthreats has forced them to invest
on mechanisms that efficiently consume shared threat
intelligence information and reduce response times in
adapting their security posture. Self-Healing mech-
anisms provide the means for administrators to ad-
dress the complexity of systems management and mit-
igate potential system faults. In this paper we pro-
posed a Self-Healing solution that has been designed
in the context of the CS-AWARE project to address
the needs of local public administrations that typi-
cally do not have the expertise or the resources to
manage security and other appliances. The proposed
solution provides a method to appropriately mitigate
cyber threats, while still allowing the system admin-
istrator to have control over these actions.
ACKNOWLEDGEMENTS
This work has been supported by the EU research pro-
gram CS-AWARE (A cybersecurity situational aware-
ness and information sharing solution for local public
administrations based on advanced big data analysis)
project. Call: DS-02-2016, Grand Agreement No.:
740723.
REFERENCES
CS-AWARE (2018). CS-AWARE framework. Deliverable
D2.4. Available online: https://cs-aware.eu/2019/03/
28/d2-4-cs-aware-framework/.
Dean, D. J., Nguyen, H., and Gu, X. (2012). UBL: unsu-
pervised behavior learning for predicting performance
anomalies in virtualized cloud systems. In Proceed-
ings of the 9th international conference on Autonomic
computing - ICAC ’12, page 191, San Jose, California,
USA. ACM Press.
Elgenedy, M. A., Massoud, A. M., and Ahmed, S. (2015).
Smart grid self-healing: Functions, applications, and
developments. In 2015 First Workshop on Smart Grid
and Renewable Energy (SGRE), pages 1–6, Doha,
Qatar. IEEE.
Keromytis, A. D. (2007). Characterizing software self-
healing systems. In Gorodetsky, V., Kotenko, I., and
Skormin, V. A., editors, Computer Network Security,
pages 22–33, Berlin, Heidelberg. Springer Berlin Hei-
delberg.
Psaier, H. and Dustdar, S. (2011). A survey on self-
healing systems: approaches and systems. Comput-
ing, 91(1):43–73.
Rantos, K., Spyros, A., Papanikolaou, A., Kritsas, A., Il-
ioudis, C., and Katos, V. (2020). Interoperability
Challenges in the Cybersecurity Information Sharing
Ecosystem. Computers, 9(1):18.
Schaberreiter, T., Kupfersberger, V., Rantos, K., Spyros, A.,
Papanikolaou, A., Ilioudis, C., and Quirchmayr, G.
(2019a). A quantitative evaluation of trust in the qual-
ity of cyber threat intelligence sources. In Proceedings
of the 14th International Conference on Availabil-
ity, Reliability and Security, ARES ’19, pages 83:1–
83:10, New York, NY, USA. ACM.
Schaberreiter, T., R
¨
oning, J., Quirchmayr, G., Kupfers-
berger, V., Wills, C. C., Bregonzio, M., Koumpis, A.,
Sales, J. E., Vasiliu, L., Gammelgaard, K., Papaniko-
laou, A., Rantos, K., and Spyros, A. (2019b). A Cy-
bersecurity Situational Awareness and Information-
Sharing Solution for Local Public Administrations
based on Advanced Big Data Analysis: The CS-
AWARE Project. In Bernabe, J. B. and Skarmeta,
A., editors, Challenges in Cybersecurity and Pri-
vacy – the European Research Landscape, RIVER
PUBLISHERS SERIES IN SECURITY AND DIGI-
TAL FORENSICS, pages 149–180. River Publishers,
Netherlands.
Schneider, C., Barker, A., and Dobson, S. (2015). A survey
of self-healing systems frameworks: A SURVEY OF
SELF-HEALING SYSTEMS. Software: Practice and
Experience, 45(10):1375–1398.
STIX (2017). Structured threat information expression
(STIX) version 2.0. OASIS standard https://www.
oasis-open.org/standards#stix2.0.
Zidan, A. and El-Saadany, E. (2012). A cooperative multi-
agent framework for self-healing mechanisms in dis-
tribution systems. Smart Grid, IEEE Transactions on,
3:1525–1539.
An Innovative Self-Healing Approach with STIX Data Utilisation
651