Organizations introducing computer and network systems need to quickly and accurately respond to information security incidents to counter intense cyber attacks. However, computer security incident response teams (CSIRTs) in organizations receive a large amount of alerts and logs that they have to investigate. Such a situation increases incident handling time. Our previous research revealed that the triage process in incident handling failed in many incident cases. In our consideration, the triage process lacks the ability to assess overall risks to modern cyber attacks. Zoning of local area networks by measuring internal-network traffic in response to such risks is important. Therefore, we propose the SPeculating INcident Zone (SPINZ) system for supporting the triage process. The SPINZ system analyzes internal-network flows and outputs an incident zone, which is composed of devices related to the incident. We evaluated the performance of the SPINZ system through simulations using two incident-flow dataset generated from two types of internal-network datasets and malicious-activity flows generated from legitimate commands. We confirm that the SPINZ system can detect an incident zone, but removing unrelated devices from an incident zone is an issue requiring further investigated.

Analyzing the behavior of an attacker is critical for determining the scope of damage of a cyber attack, recovering, and fixing system vulnerabilities. However, finding all attacker's traces from log data is a laborsome task, where the performance of existing machine learning methods is still insufficient. In this work, we focus on the task of detecting all processes that were executed by the attacker. For this task, standard anomaly detection methods like Isolation Forest, perform poorly, due to many processes that are used by both the attacker and the client user. Therefore, we propose to incorporate prior knowledge about the temporal concentration of the attacker's activity. In general, we expect that an attacker is active only during a relatively small time window (block assumption), rather than being active at completely random time points. We propose a generative model that allows us to incorporate such prior knowledge effectively. Experiments on intrusion log data, shows that the proposed method achieves considerably better detection performance than a strong baseline method which also incorporates the block assumption. CCS CONCEPTS • Security and privacy → Intrusion detection systems; • Computing methodologies → Anomaly detection; • Mathematics of computing → Bayesian computation.

No abstract

Organizations introducing computer and network systems need to quickly and accurately respond to information security incidents to counter intense cyber attacks. However, computer security incident response teams (CSIRTs) in organizations receive a large amount of alerts and logs that they have to investigate. Such a situation increases incident handling time. Our previous research revealed that the triage process in incident handling failed in many incident cases. In our consideration, the triage process lacks the ability to assess overall risks to modern cyber attacks. Zoning of local area networks by measuring internal-network traffic in response to such risks is important. Therefore, we propose the SPeculating INcident Zone (SPINZ) system for supporting the triage process. The SPINZ system analyzes internal-network flows and outputs an incident zone, which is composed of devices related to the incident. We evaluated the performance of the SPINZ system through simulations using two incident-flow dataset generated from two types of internal-network datasets and malicious-activity flows generated from legitimate commands. We confirm that the SPINZ system can detect an incident zone, but removing unrelated devices from an incident zone is an issue requiring further investigated.