Seclius: An information flow-based, consequence-centric security metric

Saman A. Zonouz, Robin Berthier, Himanshu Khurana, William H. Sanders, Tim Yardley

Research output: Contribution to journalArticlepeer-review

15 Scopus citations


It is critical to monitor IT systems that are part of energy delivery system infrastructure. The problem with intrusion detection systems (IDSes) is that they often produce thousands of alerts daily that must be dealt with by administrators manually. To provide situational awareness, detection systems usually employ (alert, priority) mappings that are either built in the IDS without consideration of the high-level mission objectives of the infrastructure, or manually defined by administrators through a time-consuming task that requires deep system-level expertise. In this paper, we present Seclius, an online security evaluation framework that translates low-level IDS alerts into a high-level system security measure and provides a ranking of past malicious events and affected system assets based on how crucial they are for the organization. Seclius significantly reduces human involvement by automatically learning system characteristics, providing a simple formalism that administrators can use to define security requirements. Experiments on a process control network with real vulnerabilities and a multistep attack show that Seclius can accurately report system security with low performance overhead and support the time-constrained security decision-making process that is necessary for critical infrastructure.

Original languageEnglish (US)
Article number6547151
Pages (from-to)562-573
Number of pages12
JournalIEEE Transactions on Parallel and Distributed Systems
Issue number2
StatePublished - Feb 1 2015
Externally publishedYes


  • information flow-based analysis
  • Intrusion detection systems
  • system security metric

ASJC Scopus subject areas

  • Hardware and Architecture
  • Signal Processing
  • Computational Theory and Mathematics


Dive into the research topics of 'Seclius: An information flow-based, consequence-centric security metric'. Together they form a unique fingerprint.

Cite this