A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 With New Scoring and Data Sources

• Type: Article in International Scientific Journal
• Date: 2025

Authors

Freitas, T (Author) Other; Novo, C (Author) Other; Dutra, I (Author) Other; Soares, J (Author) Other; Manuel E Correia (Author) FCUP; Shariati, B (Author) Other; Martins, R (Author) Other

Journal

Title: Software - Practice and Experience

ISSN: 0038-0644

Publisher: Wiley-Blackwell

Scientific classification

CORDIS: Technological sciences > Engineering > Computer engineering

FOS: Engineering and technology > Electrical engineering, Electronic engineering, Information engineering

Other information

Authenticus ID: P-019-X93

DOI: 10.1002/spe.70016

Abstract (EN): <jats:title>ABSTRACT</jats:title><jats:sec><jats:title>Background</jats:title><jats:p>Intrusion Tolerant Systems (ITS) aim to maintain system security despite adversarial presence by limiting the impact of successful attacks. Current ITS risk managers rely heavily on public databases like NVD and Exploit DB, which suffer from long delays in vulnerability evaluation, reducing system responsiveness.</jats:p></jats:sec><jats:sec><jats:title>Objective</jats:title><jats:p>This work extends the HAL 9000 Risk Manager to integrate additional real¿time threat intelligence sources and employ machine learning techniques to automatically predict and reassess vulnerability risk scores, addressing limitations of existing solutions.</jats:p></jats:sec><jats:sec><jats:title>Methods</jats:title><jats:p>A custom¿built scraper collects diverse cybersecurity data from multiple Open Source Intelligence (OSINT) platforms, such as NVD, CVE, AlienVault OTX, and OSV. HAL 9000 uses machine learning models for CVE score prediction, vulnerability clustering through scalable algorithms, and reassessment incorporating exploit likelihood and patch availability to dynamically evaluate system configurations.</jats:p></jats:sec><jats:sec><jats:title>Results</jats:title><jats:p>Integration of newly scraped data significantly enhances the risk management capabilities, enabling faster detection and mitigation of emerging vulnerabilities with improved resilience and security. Experiments show HAL 9000 provides lower risk and more resilient configurations compared to prior methods while maintaining scalability and automation.</jats:p></jats:sec><jats:sec><jats:title>Conclusions</jats:title><jats:p>The proposed enhancements position HAL 9000 as a next¿generation autonomous Risk Manager capable of effectively incorporating diverse intelligence sources and machine learning to improve ITS security posture in dynamic threat environments. Future work includes expanding data sources, addressing misinformation risks, and real¿world deployments.</jats:p></jats:sec>

Language: English

Type (Professor's evaluation): Scientific