On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

Abstract

Data mining is well-known for its ability to extract concealed and indistinct patterns in the data, which is a common task in the field of cyber security. However, data mining is not always used to its full potential among cyber security community. In this paper, we discuss usability of sequential pattern and rule mining, a subset of data mining methods, in an analysis of cyber security alerts. First, we survey the use case of data mining, namely alert correlation and attack prediction. Subsequently, we evaluate sequential pattern and rule mining methods to find the one that is both fast and provides valuable results while dealing with the peculiarities of security alerts. An experiment was performed using the dataset of real alerts from an alert sharing platform. Finally, we present lessons learned from the experiment and a comparison of the selected methods based on their performance and soundness of the results.

Towards Predicting Cyber Attacks Using Information Exchange and Data Mining

“…Similar port combinations in Top-10 rules can be seen in rules 5 and 8. In general, we can see common combinations of port numbers that are often scanned together [23]. Another example of attack progression can be seen in rule 2, where we can see two distinct attack steps, scanning and brute-forcing.…”

“…However, a generic approach similar to early attempts to attack prediction is still an open research problem [3]. Further, many of the proposed attack prediction methods have only been evaluated using the datasets, but we know little about running such methods on data from real networks [23]. In a related domain of threat intelligence, Fachkha et al [24] used data mining on darknet data to predict cyber threats in the global scope.…”

“…In our previous work [23], we have discussed sequential pattern and rule mining methods applied to the analysis of cyber security alerts. The literature search and experimental evaluation led us to the conclusion that sequential pattern mining is applicable in the correlation of security alerts, while sequential rule mining can also be applied in attack prediction.…”

“…As we can see, the sequences describe actions of an attacker behind a single IP address. Other combinations of keys and items were discussed in the previous work [23]. It is worth noting that sequential rule mining does not, by default, work with time differences between items.…”

Predictive Cyber Situational Awareness and Personalized Blacklisting

“…Perceiving the security situation via intrusion detection systems (IDS) and comprehending cyber attacks via alert correlation allows for the projection of ongoing attacks and prediction of upcoming security events. This article builds foundations from our previous work, in which we tackled various related topics, such as method selection [20], long-term observations [18], and system design [19]. Herein, we present further explorations within such fields and shed light on lessons learned towards the utmost goal of achieving attack projections and building predictive blacklisting capabilities.…”