Discovering Attackers Past Behavior to Generate Online Hyper-Alerts

Abstract

To support information security, organizations deploy Intrusion Detection Systems (IDS) that monitor information systems and networks, generating alerts for every suspicious behavior. However, the huge amount of alerts that an IDS triggers and their low-level representation make the alerts analysis a challenging task. In this paper, we propose a new approach based on hierarchical clustering that supports intrusion alert analysis in two main steps. First, it correlates historical alerts to identify the most common strategies attackers have used. Then, it associates upcoming alerts in real time according to the strategies discovered in the first step. The experiments were performed using a real dataset from the University of Maryland. The results showed that the proposed approach could properly identify the attack strategy patterns from historical alerts, and organize the upcoming alerts into a smaller amount of meaningful hyper-alerts.

Distributed Attack Modeling Approach Based on Process Mining and Graph Segmentation

“…The algorithm aggregates alerts into a graph structure according to internet provider (IP) address and attack mode and applies the Bit-AssocRule algorithm to mine frequent patterns in the model graph. Ramaki et al [ 26 ] proposed a real-time alert correlation framework based on stream mining to detect multi-step attack scenarios. First, the framework aggregate alerts into hyper-alerts and sorts them by their time tags.…”

“…Manual analysis of cyber-attacks by network security administrators is an important means to ensure network system security in practice [ 26 ]. However, attack graphs generated by state-of-the-art algorithms are extremely complex for network security administrators to understand.…”

Foundations and applications of artificial Intelligence for zero-day and multi-step attack detection

“…10 Example of graph signature in the EDL language [61] and correlation, known as the NAC process [68]. This process may be complemented by a clustering step [69,70] to enrich detection capacity.…”

“…Knowledge-based approaches include Frequent Subgraph Mining (FSM), description languages and expert systems. Machine-learning-based approaches in this classification include Bayesian networks and outlier detection, which are advanced statistical techniques, as well as Markov models [78], neural networks [79], fuzzy logic, genetic algorithms [80], ant-colony-based solutions [81] and clustering [69].…”