Cyber intrusion detection through association rule mining on multi-source logs

Lou, Ping; Lu, Guantong; Jiang, Xuemei; Zheng, Xiao; Hu, Jiwei; Yan, Junwei

doi:10.1007/s10489-020-02007-5

Cited by 20 publications

(8 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A complementary explanation of that phenomenon is that there is no affirmed threat model for microservices, e.g ., due to the difficulty of making the model specific enough for microservices yet avoiding the infamous problem of threat explosion, where the effort required to prioritise and consider all threats starts exceeding the benefits of proposing methods to manage them Wuyts et al (2018) . Threat explosion is a known problem of neighbouring areas to microservices, like cloud, edge, and fog computing ( Di Francesco, Malavolta & Lago, 2017 ; Ibrahim, Bozhinoski & Pretschner, 2019 ; Guija & Siddiqui, 2018 ; Lou et al, 2020 ; Flora, 2020 ; Truong & Klein, 2020 ; Russinovich et al, 2021 ) where the authors resorted to defining smaller, customised threat models rather than adopting standard ones, due to the problem of requiring conspicuous adaptation efforts to tailor them to such complex and multifaceted architectures.…”

Section: Review Resultsmentioning

confidence: 99%

Microservice security: a systematic literature review

Berardi

Giallorenzo

Mauro

et al. 2022

PeerJ Computer Science

View full text Add to dashboard Cite

Microservices is an emerging paradigm for developing distributed systems. With their widespread adoption, more and more work investigated the relation between microservices and security. Alas, the literature on this subject does not form a well-defined corpus: it is spread over many venues and composed of contributions mainly addressing specific scenarios or needs. In this work, we conduct a systematic review of the field, gathering 290 relevant publications—at the time of writing, the largest curated dataset on the topic. We analyse our dataset along two lines: (a) quantitatively, through publication metadata, which allows us to chart publication outlets, communities, approaches, and tackled issues; (b) qualitatively, through 20 research questions used to provide an aggregated overview of the literature and to spot gaps left open. We summarise our analyses in the conclusion in the form of a call for action to address the main open challenges.

show abstract

Section: Review Resultsmentioning

confidence: 99%

Microservice security: a systematic literature review

Berardi

Giallorenzo

Mauro

et al. 2022

PeerJ Computer Science

View full text Add to dashboard Cite

show abstract

“…In Reference 73, the security log rule basis is important for security managers to perform vulnerability detection and intrusion detection. A technique based on an adaptive‐miner algorithm is provided to create a rule base for cyber ID.…”

Section: Intrusion Detection Systemsmentioning

confidence: 99%

A systematic literature review of intrusion detection systems in the cloud‐basedIoTenvironments

Luo¹,

Chen²,

Mohammed

2022

Concurrency and Computation

View full text Add to dashboard Cite

As the number of Internet of Things (IoT) subscribers, services, and applications grows, there is a pressing need for a reliable and lightweight security solution that can be used in IoT contexts. Also, due to the open nature of cloud computing, safety concerns are always challenging. One potential solution for this problem is an intrusion detection system (IDS). An ID that utilizes a machine learning method is gaining popularity since it has the benefit of automatically updating to fight against any new form of attack. Due to the importance of IDS in cloud-based IoT, the main articles and essential techniques in this domain are examined systematically. In cloud-based IoT, IDSs are categorized into three major categories, including learning-based, pattern-based, and rule-based mechanisms. The findings illustrate that the biggest challenge in IDS is precision and detection, which many researchers are trying to improve. Also, with the rise of connected objects, the most frequently utilized centralized (cloud-based) IDS struggles with excessive latency and network overhead, leading to delayed detection of unauthorized users and unresponsiveness to assaults. The results will be valuable for academicians, and they can offer visions for future research.

show abstract

“…In [10] association rules were extracted from multi-source security logs (e.g., snort, firewall, and system logs) captured in a cloud environment to identify attackers' intrusion behaviour. Data were gathered through simulation of intrusion attacks.…”

Section: Related Workmentioning

confidence: 99%

“…As a result, attack patterns followed by attackers can be identified by correlating the executed commands. These attack patterns can be used either as part of an IDS to facilitate the detection of the attacks [10] or to further analyse the behaviour of attackers and extract insights.…”

Section: Pattern Identification Using Arlmentioning

confidence: 99%

“…Different research efforts have used ARL methods for rulelearning based IDS operating either on the network or host environment of an infrastructure. Such efforts use publicly available datasets of raw network binary TCP data 1 [3], or combine data from various sources collected at host level, such as IDS, firewall, and system logs [10]. Data collected from hosts can be used to obtain richer information about the behaviour of attackers (such as specific commands that they run) which can then be used to extract more advanced intelligence about their actions [10].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Host-based Cyber Attack Pattern Identification on Honeypot Logs Using Association Rule Learning

Papoutsis

Iliou

Kavallieros

et al. 2022

2022 IEEE International Conference on Cyber Security and Resilience (CSR)

View full text Add to dashboard Cite

Attack pattern identification is a significant step for protecting organisations from cyber-threats, as it can be used to reveal valuable patterns, enabling the better detection and analysis of the respective attacks that can be leveraged for the development of effective and efficient Intrusion Detection Systems. In this work, Association Rule Learning (ARL), a data mining technique, is used for the identification of attack patterns from data collected from a public honeypot. Using the FP-Growth ARL algorithm, we identified different patterns of attacks and correlated the respective commands executed by various attackers. To our knowledge, this is the first time ARL has been used to extract attack patterns from commands run by the attackers using real-world log data collected at the host level.

show abstract

Cyber intrusion detection through association rule mining on multi-source logs

Cited by 20 publications

References 31 publications

Microservice security: a systematic literature review

Microservice security: a systematic literature review

A systematic literature review of intrusion detection systems in the cloud‐basedIoTenvironments

Host-based Cyber Attack Pattern Identification on Honeypot Logs Using Association Rule Learning

Contact Info

Product

Resources

About