<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-00747144</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-03T09:31:08+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Individual countermeasure selection based on the return on response investment index</title>
            <author role="aut">
              <persName>
                <forename type="first">Gustavo Daniel</forename>
                <surname>Gonzalez Granadillo</surname>
              </persName>
              <email type="md5">5c556a2772969b5c21e0aad48f99362a</email>
              <email type="domain">it-sudparis.eu</email>
              <idno type="idhal" notation="numeric">929078</idno>
              <idno type="halauthorid" notation="string">654223-929078</idno>
              <orgName ref="#struct-0"/>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-638"/>
              <affiliation ref="#struct-441569"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Hervé</forename>
                <surname>Debar</surname>
              </persName>
              <email type="md5">0db2034ce3b1cb2f236b246418b2db62</email>
              <email type="domain">gmail.com</email>
              <idno type="idhal" notation="string">herve-debar</idno>
              <idno type="idhal" notation="numeric">175424</idno>
              <idno type="halauthorid" notation="string">4309-175424</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-1344-4167</idno>
              <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=KSLoggcAAAAJ&amp;hl=fr</idno>
              <idno type="IDREF">https://www.idref.fr/103969284</idno>
              <affiliation ref="#struct-95600"/>
              <affiliation ref="#struct-638"/>
              <affiliation ref="#struct-441569"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Grégoire</forename>
                <surname>Jacob</surname>
              </persName>
              <idno type="halauthorid">663782-0</idno>
              <affiliation ref="#struct-95600"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Chrystel</forename>
                <surname>Gaber</surname>
              </persName>
              <idno type="halauthorid">318874-0</idno>
              <affiliation ref="#struct-108312"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Mohamed</forename>
                <surname>Achemlal</surname>
              </persName>
              <idno type="halauthorid">449219-0</idno>
              <affiliation ref="#struct-108312"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Médiathèque</forename>
                <surname>Télécom SudParis &amp; Institut Mines-Télécom Business School</surname>
              </persName>
              <email type="md5">8d9568058c47dcee2bc21ac2481f44c9</email>
              <email type="domain">imtbs-tsp.eu</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2012-10-30 15:30:37</date>
              <date type="whenModified">2026-01-21 03:28:45</date>
              <date type="whenReleased">2012-10-30 15:30:37</date>
              <date type="whenProduced">2012-10-16</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="142673">
                <persName>
                  <forename>Médiathèque</forename>
                  <surname>Télécom SudParis &amp; Institut Mines-Télécom Business School</surname>
                </persName>
                <email type="md5">8d9568058c47dcee2bc21ac2481f44c9</email>
                <email type="domain">imtbs-tsp.eu</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-00747144</idno>
            <idno type="halUri">https://hal.science/hal-00747144</idno>
            <idno type="halBibtex">gonzalezgranadillo:hal-00747144</idno>
            <idno type="halRefHtml">&lt;i&gt;MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security"&lt;/i&gt;, Oct 2012, Saint Petersburg, Russia. pp.156-170, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-642-33704-8_14"&gt;&amp;#x27E8;10.1007/978-3-642-33704-8_14&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security", Oct 2012, Saint Petersburg, Russia. pp.156-170, &amp;#x27E8;10.1007/978-3-642-33704-8_14&amp;#x27E9;</idno>
            <availability status="restricted"/>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="TELECOM-SUDPARIS" corresp="INSTITUT-MINES-TELECOM">Télécom SudParis</idno>
            <idno type="stamp" n="INSTITUTS-TELECOM">composantes instituts telecom </idno>
            <idno type="stamp" n="INSTITUT-MINES-TELECOM">Institut Mines Telecom</idno>
            <idno type="stamp" n="IP-PARIS-DEPARTEMENT-MATHEMATIQUES">Département de Mathèmatiques</idno>
            <idno type="stamp" n="IP-PARIS-MATHEMATIQUES">IP Paris Département de Mathématiques</idno>
            <idno type="stamp" n="SAMOVAR">Services répartis, Architectures, Modélisation, Validation, Administration des Réseaux</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Individual countermeasure selection based on the return on response investment index</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Gustavo Daniel</forename>
                    <surname>Gonzalez Granadillo</surname>
                  </persName>
                  <email type="md5">5c556a2772969b5c21e0aad48f99362a</email>
                  <email type="domain">it-sudparis.eu</email>
                  <idno type="idhal" notation="numeric">929078</idno>
                  <idno type="halauthorid" notation="string">654223-929078</idno>
                  <orgName ref="#struct-0"/>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-638"/>
                  <affiliation ref="#struct-441569"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Hervé</forename>
                    <surname>Debar</surname>
                  </persName>
                  <email type="md5">0db2034ce3b1cb2f236b246418b2db62</email>
                  <email type="domain">gmail.com</email>
                  <idno type="idhal" notation="string">herve-debar</idno>
                  <idno type="idhal" notation="numeric">175424</idno>
                  <idno type="halauthorid" notation="string">4309-175424</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-1344-4167</idno>
                  <idno type="GOOGLE SCHOLAR">https://scholar.google.fr/citations?user=KSLoggcAAAAJ&amp;hl=fr</idno>
                  <idno type="IDREF">https://www.idref.fr/103969284</idno>
                  <affiliation ref="#struct-95600"/>
                  <affiliation ref="#struct-638"/>
                  <affiliation ref="#struct-441569"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Grégoire</forename>
                    <surname>Jacob</surname>
                  </persName>
                  <idno type="halauthorid">663782-0</idno>
                  <affiliation ref="#struct-95600"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Chrystel</forename>
                    <surname>Gaber</surname>
                  </persName>
                  <idno type="halauthorid">318874-0</idno>
                  <affiliation ref="#struct-108312"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Mohamed</forename>
                    <surname>Achemlal</surname>
                  </persName>
                  <idno type="halauthorid">449219-0</idno>
                  <affiliation ref="#struct-108312"/>
                </author>
              </analytic>
              <monogr>
                <idno type="localRef">12392</idno>
                <idno type="halJournalId" status="INCOMING">77467</idno>
                <title level="j">MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security"</title>
                <title level="m">MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security"</title>
                <title level="m">MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security"</title>
                <meeting>
                  <title>MMM-ACNS '12 : Sixth International Conference "Mathematical Methods, Models, and Architectures for Computer Network Security"</title>
                  <date type="start">2012-10-16</date>
                  <date type="end">2012-10-19</date>
                  <settlement>Saint Petersburg</settlement>
                  <country key="RU">Russia</country>
                </meeting>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="volume">7531</biblScope>
                  <biblScope unit="pp">156-170</biblScope>
                  <date type="datePub">2012</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-642-33704-8_14</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Impact analysis</term>
                <term xml:lang="en">Countermeasure selection</term>
                <term xml:lang="en">Risk mitigation</term>
                <term xml:lang="en">Return on response investment</term>
                <term xml:lang="en">Mobile money transfer service</term>
              </keywords>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halDomain" n="info.info-ni">Computer Science [cs]/Networking and Internet Architecture [cs.NI]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>As the number of attacks, and thus the number of alerts received by Security Information and Event Management Systems (SIEMs) increases, the need for appropriate treatment of these alerts has become essential. The new generation of SIEMs focuses on the response ability to automate the process of selecting and deploying countermeasures. However, current response systems select and deploy security measures without performing a comprehensive impact analysis of attacks and response scenarios. This paper addresses this limitation by proposing a model for the automated selection of optimal security countermeasures. In addition, the paper compares previous mathematical models and studies their limitations, which lead to the creation of a new model that evaluates, ranks and selects optimal countermeasures. The model relies on the optimization of cost sensitive metrics based on the Return On Response Investment (RORI) index. The optimization compares the expected impact of the attacks when doing nothing with the expected impact after applying countermeasures. A case study of a real infrastructure is deployed at the end of the document to show the applicability of the model over a Mobile Money Transfer Service.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="department" xml:id="struct-95600" status="VALID">
          <orgName>Département Réseaux et Services de Télécommunications</orgName>
          <orgName type="acronym">TSP - RST</orgName>
          <desc>
            <address>
              <addrLine>Télécom SudParis - 9 rue Charles Fourier - 91011 Évry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://rst.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-638" status="VALID">
          <idno type="IdRef">281286515</idno>
          <idno type="ISNI">0000000403830480</idno>
          <idno type="RNSR">200319330C</idno>
          <orgName>Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux</orgName>
          <orgName type="acronym">SAMOVAR</orgName>
          <desc>
            <address>
              <addrLine>Télécom Sudparis, 9 rue Charles Fourier -91011 Evry cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://samovar.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-352124" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
            <relation name="563936" active="#struct-563936" type="indirect"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-108312" status="VALID">
          <orgName>Orange Labs [Caen]</orgName>
          <desc>
            <address>
              <addrLine>Orange Labs 42 rue des Coutures 14066 Caen, France,</addrLine>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-365900" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-352124" status="VALID">
          <idno type="IdRef">162347510</idno>
          <idno type="ISNI">0000000406406351</idno>
          <idno type="ROR">https://ror.org/05xvk4r52</idno>
          <idno type="Wikidata">Q43305</idno>
          <orgName>Télécom SudParis</orgName>
          <orgName type="acronym">TSP</orgName>
          <desc>
            <address>
              <addrLine>9 rue Charles Fourier -91011 Evry Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.telecom-sudparis.eu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
            <relation name="563936" active="#struct-563936" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-563936" status="VALID">
          <idno type="IdRef">238327159</idno>
          <idno type="ISNI">0000000502717600</idno>
          <idno type="ROR">https://ror.org/042tfbd02</idno>
          <idno type="Wikidata">Q48759778</idno>
          <orgName>Institut Polytechnique de Paris</orgName>
          <orgName type="acronym">IP Paris</orgName>
          <date type="start">2019-06-02</date>
          <desc>
            <address>
              <addrLine>Route de Saclay, 91120 Palaiseau Cedex, France</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.ip-paris.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-365900" status="VALID">
          <orgName>Orange Labs</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>