Mitigating Actions for Computing System Intrusion Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion recovery systems for computing platforms can restore a compromised system to a previous safe state but fail to prevent re-infection and recurring attacks, as they do not address ongoing vulnerabilities and allow attackers to re-inflect the system.
Innovation Solution
The implementation of a recovery and mitigation system that places the system in a degraded mode, restricts attacker capabilities, and applies mitigation actions such as privilege de-escalation and resource quota modifications, using an IDS and state data storage to maintain core functions and prevent re-infection, while allowing core services to continue operating.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system is restored to a previous safe state using roll-back mechanisms, then the immediate damage caused by intrusion is temporarily addressed, but the system remains vulnerable to re-infection and recurring attacks
Solution Approach 1:
The system performs preliminary actions by identifying vulnerabilities and applying mitigation measures before the system is fully restored. The mitigation system applies security patches, updates antivirus definitions, and configures security policies in advance during the degraded mode period, so that when the system returns to normal operation, it is already protected against re-infection
Solution Approach 2:
The system applies preliminary anti-action by implementing counter-measures against potential attacks during the degraded mode. Mitigation actions such as blocking malicious IP addresses, disabling vulnerable services, and applying security patches are performed before full system restoration, preventing the attacker from re-infecting the system
2Productivity
If the system operates in normal mode after intrusion, then full functionality is maintained, but the system remains exposed to ongoing threats and re-infection
Solution Approach 1:
The system dynamically adjusts its operational state between degraded mode and normal mode based on threat levels. During degraded mode, non-essential functions are restricted while security mitigations are applied. Once mitigations are complete and threats are neutralized, the system transitions to normal mode with full functionality restored, creating a dynamic response that balances security and productivity
Solution Approach 2:
The mitigation system acts as an intermediary layer between the intruded system and external threats. It applies security policies, filters malicious traffic, and enforces access controls that protect the system while allowing legitimate operations to proceed, enabling the system to function normally while remaining protected
3Reliability
If mitigation actions are applied to prevent re-infection, then system resilience is improved, but some system functions may be restricted in degraded mode
Solution Approach 1:
The system applies partial mitigation actions by selectively restricting only non-essential functions during degraded mode while maintaining core business-critical operations. Essential services continue to function with reduced capabilities, while non-essential services are temporarily disabled or restricted, applying just enough mitigation to prevent re-infection without completely halting productivity
Data Source
AI summary
In an example there is provided a method of applying a mitigation action to a computing system. The method comprises receiving notification of an intrusion event on a computing system. The notification identifies one or more of data, and a process affected by the intrusion event. The method comprises accessing state data corresponding to a state of the computing system prior to the intrusion event, accessing a policy specifying one or more mitigation actions to be applied to the one or more of data, and a process in response to an intrusion event, restoring the one or more of data, and the process on the basis of the state data, and applying a mitigation action according to the policy.