Towards an Autonomous Response System. Case: Denial of Service Attacks

Intrusion Detection Systems and similar tools continuously update their rule sets to align with evolving attack techniques across monitored and protected infrastructures. However, the ever-evolving threat landscape presents a significant challenge, as not every intrusion attempt can be reliably captured. Even upon detection, the efficacy of intrusion mitigation hinges on the agility of the response team and the chosen actions. In this work, we propose the implementation of a machine learning-driven Intrusion Response System (IRS) using the MAPE-K feedback loop cycle. This architecture empowers autonomous protection for multiple client machines against denial of service attacks. Our approach leverages the power of machine learning to enhance detection accuracy and response timeliness, addressing the limitations of traditional rule-based systems. Our experimental results demonstrate promising outcomes. Particularly, our basic implementation of port management showcases robust performance against denial of service attacks. This research contributes to the advancement of proactive cybersecurity measures by harnessing the potential of machine learning in intrusion detection and response, ultimately bolstering the overall security posture of network infrastructures.