Network attacks evolved from single-step and simple attacks to complex multistep attacks.Current methods of multistep attack detection usually match multistep attacks from intrusion detection systems(IDS)alarms based ...Network attacks evolved from single-step and simple attacks to complex multistep attacks.Current methods of multistep attack detection usually match multistep attacks from intrusion detection systems(IDS)alarms based on the correlation between attack steps.However,IDS has false negatives and false positives,which leads to incomplete or incorrect multistep attacks.Association based on simple similarity is difficult to obtain an accurate attack cluster,while association based on prior knowledge such as attack graphs is difficult to guarantee a complete attack knowledge base.To solve the above problems,a heuristic multistep attack scenarios construction method based on the kill chain(HMASCKC)model was proposed.The attack model graph can be obtained from dual data sources and heuristic multistep attack scenarios can be obtained through graph matching.The model graph of the attack and the predicted value of the next attack are obtained by calculating the matching value.And according to the purpose of the multistep attack,the kill chain model is used to define the initial multistep attack model,which is used as the initial graph for graph matching.Experimental results show that HMASCKC model can better fit the multistep attack behavior,the effect has some advantages over the longest common subsequence(LCS)algorithm,which can close to or match the prediction error of judge evaluation of attack intension(JEAN)system.The method can make multistep attack model matching for unknown attacks,so it has some advantages in practical application.展开更多
This paper presents a novel probability generation algorithm to predict attacks from an insider who exploits known system vulnerabilities through executing authorized operations. It is different from most intrusion de...This paper presents a novel probability generation algorithm to predict attacks from an insider who exploits known system vulnerabilities through executing authorized operations. It is different from most intrusion detection systems （IDSs） because these IDSs are inefficient to resolve threat from authorized insiders. To deter cracker activities, this paper introduces an improved structure of augmented attack tree and a notion of ＂minimal attack tree＂, and proposes a new generation algorithm of minimal attack tree. We can provide a quantitative approach to help system administrators make sound decision.展开更多
针对大规模网络环境下海量告警信息的重复性、不完整和不可管理给网络安全管理带来的新的挑战,提出了一种基于因果关系的实时入侵告警关联(RIAC)系统,以解决海量告警的实时关联和可视化管理问题。此RIAC系统利用分布式Agent实时地捕获...针对大规模网络环境下海量告警信息的重复性、不完整和不可管理给网络安全管理带来的新的挑战,提出了一种基于因果关系的实时入侵告警关联(RIAC)系统,以解决海量告警的实时关联和可视化管理问题。此RIAC系统利用分布式Agent实时地捕获和预处理告警信息,然后由因果关联引擎对其进行分析和处理,从而揭示告警信息背后隐藏的攻击场景和攻击意图。使用MIT Lincoln Lab提供的攻击场景数据集LLDOS1.0和真实IPv6数据集对该RIAC系统进行了测试,实验结果验证了其有效性和实时性。展开更多
基金supported by the Science and Technology Project of the Headquarters of State Grid Corporation of China(5700-202152186A-0-0-00)。
文摘Network attacks evolved from single-step and simple attacks to complex multistep attacks.Current methods of multistep attack detection usually match multistep attacks from intrusion detection systems(IDS)alarms based on the correlation between attack steps.However,IDS has false negatives and false positives,which leads to incomplete or incorrect multistep attacks.Association based on simple similarity is difficult to obtain an accurate attack cluster,while association based on prior knowledge such as attack graphs is difficult to guarantee a complete attack knowledge base.To solve the above problems,a heuristic multistep attack scenarios construction method based on the kill chain(HMASCKC)model was proposed.The attack model graph can be obtained from dual data sources and heuristic multistep attack scenarios can be obtained through graph matching.The model graph of the attack and the predicted value of the next attack are obtained by calculating the matching value.And according to the purpose of the multistep attack,the kill chain model is used to define the initial multistep attack model,which is used as the initial graph for graph matching.Experimental results show that HMASCKC model can better fit the multistep attack behavior,the effect has some advantages over the longest common subsequence(LCS)algorithm,which can close to or match the prediction error of judge evaluation of attack intension(JEAN)system.The method can make multistep attack model matching for unknown attacks,so it has some advantages in practical application.
基金Supported by the National Key Technologies Re-search and Development Programof China (2004BA907A20)
文摘This paper presents a novel probability generation algorithm to predict attacks from an insider who exploits known system vulnerabilities through executing authorized operations. It is different from most intrusion detection systems （IDSs） because these IDSs are inefficient to resolve threat from authorized insiders. To deter cracker activities, this paper introduces an improved structure of augmented attack tree and a notion of ＂minimal attack tree＂, and proposes a new generation algorithm of minimal attack tree. We can provide a quantitative approach to help system administrators make sound decision.
文摘针对大规模网络环境下海量告警信息的重复性、不完整和不可管理给网络安全管理带来的新的挑战,提出了一种基于因果关系的实时入侵告警关联(RIAC)系统,以解决海量告警的实时关联和可视化管理问题。此RIAC系统利用分布式Agent实时地捕获和预处理告警信息,然后由因果关联引擎对其进行分析和处理,从而揭示告警信息背后隐藏的攻击场景和攻击意图。使用MIT Lincoln Lab提供的攻击场景数据集LLDOS1.0和真实IPv6数据集对该RIAC系统进行了测试,实验结果验证了其有效性和实时性。
