Autonomic defense: Thwarting automated attacks via real-time feedback control

A critical threat to organizations, and the Internet itself, is a class of automated network attacks referred to as Internet worms. This article examines the use of mathematical models and optimization algorithms--specifically a partially-observable Markov decision process (PO-MDP) based feedback control system--as the basis for implementing an autonomic defense system (ADS) that can protect organizations against Internet worms. The PO-MDP ADS introduced in this article is capable of detecting and responding to worms in real time. Furthermore, the PO-MDP ADS can ameliorate the rate of incorrect control decisions that would normally occur in the presence of sensor false alarms.