Abstract—Aggressive and Intelligent Self-defensive Network (AISEN) is an open-source distributed solution that aims at deploying a semi-autonomous network, which enables internal attack deception through misguidance and illusion. In fact, instead of simply preventing or stopping the attack as do traditional Intrusion Prevention Systems (IPS), AISEN drives attackers to attack decoy machines, which clone victim machines by mimicking their personalities (e.g. OS, services running). On top of that, AISEN uses rogue machines that clone idle production machines, which are able to detect human-aware zero-day attacks not seen by IPS. The solution uses real-time dynamic high-interaction honeypot generation, and a novel rerouting schema that is both router and network architecture independent, along with a robust troubleshooting algorithm for sophisticated attacks. Information captured and data gathered from these decoy machines will give CERTs/CISRTs and forensic experts critical data relevant to the sophistication of the attack, vulnerabilities targeted, and some means of preventing it in the future. This project reviewed former designs and similar studies addressing the same issues and emphasizes the added value of this open source solution in terms of flexibility, ease of use and upgrade, deployment, and customization.

Index Terms—network, IDS, IPS, firewall, incident response, antivirus, zero-day, advanced persistent threats, internal attacks, honeypot, state-of-the-art, enterprise-class  

Cite: Ali Elouafiq, Ayoub Khobalatte Wassim Benhallam, Omar Iraqi, and Tajje-eddineRachidi, "Aggressive and Intelligent Self-defensive Network Towards a new generation of semi-autonomous Networks," Journal of Emerging Technologies in Web Intelligence, Vol. 5, No. 1, pp. 12-17, February 2013. doi:10.4304/jetwi.5.1.12-17