Network entity characterization and attack prediction

Abstract

The devastating effects of cyber-attacks, highlight the need for novel attack detection and prevention techniques. Over the last years, considerable work has been done in the areas of attack detection as well as in collaborative defense. However, an analysis of the state of the art suggests that many challenges exist in prioritizing alert data and in studying the relation between a recently discovered attack and the probability of it occurring again. In this article, we propose a system that is intended for characterizing network entities and the likelihood that they will behave maliciously in the future. Our system, namely Network Entity Reputation Database System (NERDS), takes into account all the available information regarding a network entity (e. g. IP address) to calculate the probability that it will act maliciously. The latter part is achieved via the utilization of machine learning. Our experimental results show that it is indeed possible to precisely estimate the probability of future attacks from each entity using information about its previous malicious behavior and other characteristics. Ranking the entities by this probability has practical applications in alert prioritization, assembly of highly effective blacklists of a limited length and other use cases.

Predictive Cyber Situational Awareness and Personalized Blacklisting

“…Further works improved the hit counts but did not discuss the hit rates [17,32,38]. The highest hit rates were achieved by Bartoš et al [2], but the hit rate degrades with the size of the blacklist, as presented in Table 1. The success rate of around 65 % in our work outperforms previous works even with large blacklists.…”

“…Finally, Melis et al [32] combined two of the previous approaches [17,38], and achieved balance of their strengths and weaknesses, again on DShield data. Predictive blacklisting is also the desired use case of network entity reputation scoring in the work of Bartoš et al [2], who used the data from the SABU alert sharing platform [6] that was also used in this work. The attention of the researchers in the field is also focused on countermeasure selection, e.g., as surveyed by Nespoli et al [33].…”

Dataset of intrusion detection alerts from a sharing platform

“…The data set offers an up-to-date view of network security alerts and reflects the current cybersecurity threat landscape. The data set encourages experimenting with the advanced methods of alert aggregation and correlation [4] , including temporal and spatial correlations [6] , reputation scoring [7] , attack scenario reconstruction [8] , and attack projection [9] . Alert correlation and attack scenario reconstructions methods allow inferring insights into the behavior of the attackers.…”

IP Reputation Scoring with Geo-Contextual Feature Augmentation

“…Interestingly, Antonakakis, Perdisci, Dagon, Lee, and Feamster [2010] propose a dynamic approach to reputation scoring that adjusts the reputation score according to the level of maliciousness. However, Pronk [2011] and Bartos et al [2019] highlight limitations associated with dependence on blacklists, where attack signatures may change and thus render blacklists inefficient. Pronk [2011] describes IP reputation as a concept of rating a host based on their past actions and comparing high-level information such as domain names to a group of hosts whose reputation is known.…”