Evidence accrual technique for information assurance

Abstract

Information assurance is the process of protecting information from theft, destruction, or manipulation. While many attacks are straightforward such as denial of service or viruses in that they require just a step or two to implement, more dangerous can require numerous steps to implement. Often, these steps need not be done in quick succession or even in a definite order. While techniques have been developed to behave as sensors to quickly assess elements of attacks, they rely on a decision engine to fuse the information to estimate whether or not an attack is underway. To identify such attacks, an evidence accrual system is proposed fuse information and estimate the possibility of an attack. The technique is based on a systems approach to combining information and provides nit only a level of evidence but a degree of uncertainty about the estimate.