An attack-norm separation approach for detecting cyber attacks

Abstract

The two existing approaches to detecting cyber attacks on computers and networks, signature recognition and anomaly detection, have shortcomings related to the accuracy and efficiency of detection. This paper describes a new approach to cyber attack (intrusion) detection that aims to overcome these shortcomings through several innovations. We call our approach attack-norm separation. The attacknorm separation approach engages in the scientific discovery of data, features and characteristics for cyber signal (attack data) and noise (normal data). We use attack profiling and analytical discovery techniques to generalize the data, features and characteristics that exist in cyber attack and norm data. We also leverage well-established signal detection models in the physical space (e.g., radar signal detection), and verify them in the cyberspace. With this foundation of information, we build attack-norm separation models that incorporate both attack and norm characteristics. This enables us to take the least amount of relevant data necessary to achieve detection accuracy and efficiency. The attack-norm separation approach considers not only activity data, but also state and performance data along the cause-effect chains of cyber attacks on computers and networks. This enables us to achieve some detection adequacy lacking in existing intrusion detection systems.

Ağ Sistemlerinin Güvenliği İçin Siber Saldırıların Ayrık Olaylı Sistem Tanımlama Tabanlı Modellenmesi ve Simülasyonu

“…Bazı araştırmacılar, saldırı türlerini, gelecek hedeflerini, sınıflandırmanın ölçümünü ve açıklamalarını anlatmak amacıyla siber saldırıların risk değerlendirmesine vurgu yaparak siber saldırıların bir sınıflandırmasını vermiş ve bilgisayar sistemlerindeki kusur ve zafiyetlerin kapsamlı bir analizini yapmışlardır [22]. Farklı araştırmacılar mobil bilgi işlem için güvenlik açıkları ve tehditlerin bir sınıflandırmasını, saldırının alt tipleri, işletim sistemi aygıtı üzerindeki etkisini, özel savunma tekniklerini ve verilen hasarları tanımlayan birçok farklı saldırı türünü açıklamıştır [23][24][25][26].…”

Reconciliation of Privacy with Preventive Cybersecurity: The Bright Internet Approach

“…The research in Information Systems Frontiers (ISF) particularly stressed the cyber risk assessment (Mukhopadhyay et al 2019), security risk mitigation (Ye et al 2006), IT security investment (Ezhei and Ladani 2018), information security policy (Kang and Hovav 2018), and security risk management (Lee and Lee 2012). In this regard, ISF's research also focuses more on the organization and employee aspect of cybersecurity issues.…”

Security mistakes in information system deployment projects

“…Taxonomies describing these include e.g. (Aslam, Krsul & Spafford 1996) (Alves-Foss & Barbosa 1995) (Bishop & Bailey 1996) (Yoshioka, Washizaki & Maruyama 2008) (Ye, Newman & Farley 2006) (Hansman and Hunt, 2004). Three of these studies are outlined below.…”