Quality of detectability (QoD) and QoD-aware AAT-based attack detection

Network attacks occur in high proportion on the internet, thus aside from security as a means of defense there is a need for being able to detect attacks as they occur so that measures can be put in place to tackle them. For this, an intrusion detection system (IDS) is required that has good quality of detection capability. We propose Quality of Detectability (QoD) as a kind of Quality of Service (QoS)-like detection quality mechanism. Two major contributions are given in this paper: (1) the notion of QoD to measure the attack detection capability; (2) an extended Augmented Attack Tree (AAT) and corresponding intrusion detection algorithm with QoD capabilities.