Clustering of multistage cyber attacks using significant services

Murphy, Christopher; Yang, Shanchieh Jay

doi:10.1109/icif.2010.5712046

Cited by 4 publications

(3 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Analysing multi-Step attacks Alert clustering, alert merging and intent recognition [80], alert correlation framework [278], causal correlation [281], clustered adjacency matrices [285], divide and conquer framework [220], divisive hierarchical clustering algorithm [272], exploit dependency graph [73], other contributions include: [91,228,273,238,349,14,64,173,329] Attack path analysis…”

Section: Event Predictionmentioning

confidence: 99%

“…Graph based network vulnerability analysis [313], clustered adjacency matrices [285], ranked attack graph using PageRank [256], dependency attack graphs [344], optimal IDS placement [21,287], NetSPA [169], attack response graph [241] Predicting the impact of configuration settings Reverse graph traversal for identifying critical preconditions and vulnerabilities [403], ranked attack graph [256], adjacency matrix clustering method and reachability analysis [285], predictive graph [169,229,287], divisive hierarchical clustering algorithm [272] of a successful attack path. Each node in the graph represents a potential vulnerability and the preconditions and postconditions associated with the vulnerability.…”

Section: Optimal Device Configurationmentioning

confidence: 99%

See 1 more Smart Citation

A review of attack graph and attack tree visual syntax in cyber security

Lallie

Debattista

Bal

2020

Computer Science Review

147

View full text Add to dashboard Cite

show abstract

Section: Event Predictionmentioning

confidence: 99%

Section: Optimal Device Configurationmentioning

confidence: 99%

A review of attack graph and attack tree visual syntax in cyber security

Lallie

Debattista

Bal

2020

Computer Science Review

147

View full text Add to dashboard Cite

show abstract

“…They apply a double clustering followed by a loose application of LCS (Longest Common Subsequence). Moreover, Murphy uses a similarity matrix based on the services each attack exploits [14,15]. Clusters of alerts are extracted using Divisive Hierarchical Clustering (DHC) on a social network graph derived from the similarity matrix.…”

Section: Background and Related Workmentioning

confidence: 99%

Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation

Cheng

Zhang

Chen

2019

Sensors

View full text Add to dashboard Cite

With the emergence of the Advanced Persistent Threat (APT) attacks, many Internet of Things (IoT) systems have faced large numbers of potential threats with the characteristics of concealment, permeability, and pertinence. However, existing methods and technologies cannot provide comprehensive and prompt recognition of latent APT attack activities in the IoT systems. To address this problem, we propose an APT Alerts and Logs Correlation Method, named APTALCM and a framework of deploying APTALCM on the IoT system, where an edge computing architecture was used to achieve cyber situation comprehension without too much data transmission cost. Specifically, we firstly present a cyber situation ontology for modeling the concepts and properties to formalize APT attack activities in the IoT systems. Then, we introduce a cyber situation instance similarity measurement method based on the SimRank mechanism for APT alerts and logs Correlation. Combining with instance similarity, we further propose an APT alert instances correlation method to reconstruct APT attack scenarios and an APT log instances correlation method to detect log instance communities. Through the coalescence of these methods, APTALCM can accomplish the cyber situation comprehension effectively by recognizing the APT attack intentions in the IoT systems. The exhaustive experimental results demonstrate that the two kernel modules, i.e., Alert Instance Correlation Module (AICM) and Log Instance Correlation Module (LICM) in our APTALCM, can achieve both high true-positive rate and low false-positive rate.

show abstract

A Vulnerability Attack Graph Generation Method Based on Scripts

Han

Wang

et al. 2012

Information Computing and Applications

View full text Add to dashboard Cite

Clustering of multistage cyber attacks using significant services

Cited by 4 publications

References 8 publications

A review of attack graph and attack tree visual syntax in cyber security

A review of attack graph and attack tree visual syntax in cyber security

Cyber Situation Comprehension for IoT Systems based on APT Alerts and Logs Correlation

A Vulnerability Attack Graph Generation Method Based on Scripts

Contact Info

Product

Resources

About