Attack Containment Framework for Large-Scale Critical Infrastructures

Abstract

We present an attack containment framework against value-changing attacks in large-scale critical infrastructures, based on early warning and cooperative response approaches. We define an information structure, called attack container, which captures the trust behavior of a group of nodes and assists to contain the damage of the attack. The attack container is then used for distributed early warning and cooperative response in our framework. The simulation results show that our containment framework can detect, mitigate and contain large-scale attacks quickly.