Semi-autonomous Link Layer Vulnerability Discovery and Mitigation Dissemination. / Wolthusen, Stephen D.; Al-Salloum, Ziyad.

Proceedings of the Fifth International Conference on IT Security Incident Management and IT Forensics 2009. IEEE Computer Society Press, 2009. p. 41-53.

Research output: Chapter in Book/Report/Conference proceedingConference contribution



Risk and vulnerability management is a critical task in maintaining any nontrivial network, but made increasingly difficult by the dynamic nature of internetworking, transient connectivity, and the use of virtual machines that are connected intermittently, while both real and virtual hosts may harbor vulnerabilities that must be addressed to protect both the vulnerable host and its environment whether these are known to an organizationpsilas asset database or not. This is particularly critical if a security incident is in progress and the exposure to a vulnerability must be assessed and potentially mitigated as quickly and completely as possible. In this paper we therefore propose a probabilistic discovery and mitigation algorithm traversing a network with only knowledge of the immediate network neighborhood as can be obtained from passive observation of the LLDP protocol to minimize bandwidth consumption in conjunction with persistent agents deployed by the traversal to capture transient or intermittently active nodes and provide an analysis of the algorithmpsilas efficiency under different topologies and taking into account link failure as well as inconclusive or failed discovery and mitigation operation probabilities.
Original languageEnglish
Title of host publicationProceedings of the Fifth International Conference on IT Security Incident Management and IT Forensics 2009
PublisherIEEE Computer Society Press
ISBN (Print)978-0-7695-3807-5
Publication statusPublished - 15 Sep 2009
This open access research output is licenced under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License.

ID: 5129474