An Attack Description and Response Architecture Based on Multi-level Rule Expression Language

In the recent years, cyber-attacks have increased rapidly and have become more diverse and unpredictable. Having devastating impacts, the selection of appropriate countermeasures has become a major challenge. We present an attack description and response system based on multi-level rule expression language. It provides a framework to evaluate, identify, classify and defend against sophisticated attacks. Our approach helps simplify complex rules' expression and event handling, thanks to a modular architecture and intuitive rules along with a powerful expression language. The proposed system is flexible and takes into consideration several attack properties in order to simplify attack handling and aggregate defense mechanisms.