A hierarchical and factored POMDP based automated intrusion response framework

In this paper, we formulate intrusion response problem as a factored Partially Observed Markov Decision Process (POMDP) model. Furthermore, a hierarchical planning algorithm is presented to decompose overall POMDP into some small sub-POMDPs and compute global optimal response policy according to MLS heuristic criterion. Meanwhile, reachable attack intention is defined and used to identify false alerts and compress belief state space. Finally, some experiments were performed to compare proposed algorithm with previous approaches and the results show that our approach have a good performance in response accuracy to different attack scenarios and robustness against false alerts.