Research on attack scenario reconstruction method based on causal knowledge discovery

Di FAN; Jing LIU; Jun-xi ZHUANG; Ying-xu LAI

doi:10.11959/j.issn.2096-109x.2017.00148

您当前的位置：

首页 >

文章列表页 >

Research on attack scenario reconstruction method based on causal knowledge discovery

Papers | 更新时间：2024-06-03

- Research on attack scenario reconstruction method based on causal knowledge discovery
- Chinese Journal of Network and Information Security Vol. 3, Issue 4, Pages: 58-68(2017)
- 作者机构：
  
  1. 北京工业大学信息学部，北京 100124
  2. 北京工业大学可信计算北京市重点实验室，北京 100124
  3. 北京工业大学信息安全等级保护关键技术国家工程实验室，北京 100124
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00148
  CLC： TP393
- Online First：2017-04，
  
  Published：15 April 2017
- 稿件说明：
移动端阅览
Di FAN, Jing LIU, Jun-xi ZHUANG, et al. Research on attack scenario reconstruction method based on causal knowledge discovery[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 58-68.
DOI：

Di FAN, Jing LIU, Jun-xi ZHUANG, et al. Research on attack scenario reconstruction method based on causal knowledge discovery[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 58-68. DOI： 10.11959/j.issn.2096-109x.2017.00148.

摘要

为了从分散的告警日志中发现攻击模式、构建攻击场景，通过分析现有攻击场景重构方法，针对现有方法因果知识复杂难懂且难以自动获取的问题，提出一种基于因果知识发现的攻击场景重构方法。所提方法首先按照知识发现的过程，通过告警日志间 IP 属性的相关程度，构建攻击场景的序列集合；然后，采用时间序列建模的方式去除误告警，以精简攻击场景序列；最后，利用概率统计方法发现各告警类型间的关联关系。在DARPA 2000数据集上对方法进行了实验验证，结果表明，该方法能有效识别多步攻击模式。

Abstract

In order to discover the attack pattern from the distributed alert data and construct the attack scene

a method of finding the attack scene from the alert data generated by intrusion detection system was studied.Current research suffer from the problem that causal knowledge is complex and difficult to understand and it is difficult to automatically acquire the problem.An attack scenario reconstruction method based on causal knowledge discovery was proposed.According to the process of KDD

the sequence set of attack scenes was constructed by the correlation degree of IP attributes among alert data.Time series modeling was adopted to eliminate the false positives to reduce the attack scene sequence.Finally

causal relationship between the alert data was found by using probability statistics.Experiments on the DARPA2000 intrusion scenario specific data sets show that the method can effectively identify the multi-step attack mode.

关键词

Keywords

references

国家计算机网络应急技术处理协调中心 . 2015 年中国互联网网络安全报告 [R ] . 2016 .

National Computer Network Emergency Response Coordination Center . The Chinese Internet network security report [R ] . 2016 .

NING P , CUI Y , REEVES D S . Techniques and tools for analyzing intrusion alerts [J ] . ACM Trans on Information and System Security , 2004 , 7 ( 2 ): 274 - 318 .

QIN X , LEE W . Statistical causality analysis of INFOSEC alert data [C ] // The 6th International Symposium on Recent Advances in Intrusion Detection . 2003 : 591 - 627 .

MAGGI F , ZANERO S . On the use of different statistical tests for alert correlation:short paper [C ] // The 10th International Conference on Recent Advances in Intrusion Detection . 2007 : 167 - 177 .

冯学伟 , 王东霞 , 黄敏桓 , 等 . 一种基于马尔可夫性质的因果知识挖掘方法 [J ] . 计算机研究与发展 , 2014 , 51 ( 11 ): 2493 - 2504 .

FENG X W , WANG D X , HUANG M H , et al . A mining approach for causal knowledge in alert correlating based on the Markov property [J ] . Journal of Computer Research and Development , 2014 , 51 ( 11 ): 2493 - 2504 .

FENG X , WANG D , ZENG J , et al . Analyzing and correlating security events using state machine [C ] // IEEE International Conference on Computer and Information Technology . 2010 : 2849 - 2854 .

TEMPLETON S J , LEVITT K . A requires/provides model for computer attacks [C ] // The 2000 Workshop on New Security Paradigms . 2000 : 31 - 38 .

NING P , CUI Y , REEVES D S . Constructing attack scenarios through correlation of intrusion alerts [C ] // The 9th ACM Conference on Computer and Communications Security . 2002 : 245 - 254 .

CUPPENS F , MIEGE A . Alert correlation in a cooperative intrusion detection framework [C ] // The 2002 IEEE Symposium on Security and Privacy . 2002 : 202 - 215 .

CUPPENS F , . Managing alerts in a multi-intrusion detection environment [C ] // The 17th Annual Computer Security Applications Conference . 2001 : 22 - 31 .

CUPPENS F , AUTREL F , MIEGE A , et al . Correlation in an intrusion detection process [C ] // The SECI02 Workshop . 2002 : 153 - 171 .

胡亮 , 解男男 , 努尔布力 , 等 . 基于智能规划的多步攻击场景识别算法 [J ] . 电子学报 , 2013 , 41 ( 9 ): 1753 - 1759 .

HU L , XIE N N , NU E B L , et al . A multi-stage attack scenario recognition algorithm based on intelligent planning [J ] . Acta Electronica Sinica , 2013 , 41 ( 9 ): 1753 - 1759

QIN X , LEE W . Discovering novel attack strategies from INFOSEC alerts [C ] // The 9th European Symposium on Research in Computer Security . 2004 : 439 - 456 .

QIN X , LEE W . Causal discovery-based alert correlation [C ] // The 21st Annual Computer Security Application Conference , 2005 : 33 - 40 .

MORIN B , DEBAR H . Correlation of intrusion symptoms:an application of chronicles [J ] . Lecture Notes in Computer Science , 2003 , 2820 : 94 - 112 .

ZHANG AF , LI Z , LI D , et al . Discovering novel multistage attack patterns in alert streams [C ] // The International Conference on Networking,Architecture,and Storage . 2007 . 115 - 121 .

王泽芳 , 袁平 , 黄晓芳 . 一种新的多步攻击场景重构技术研究 [J ] . 西南科技大学学报 , 2016 , 31 ( 1 ): 55 - 60 .

WANG Z F , YUAN P , HUANG X F . Research of a novel attack scenario constructing method [J ] . Journal of Southwest University and Technology , 2016 , 31 ( 1 ): 55 - 60 .

PIETRASZEKT , TANNER A . Data mining and machine learning-towards reducing false positives in intrusion [J ] . Information Security Technical Report , 2005 , 10 : 169 - 183 .

田志宏 , 张永铮 , 张伟哲 , 等 . 基于模式挖掘和聚类分析的自适应告警关联 [J ] . 计算机研究与发展 , 2009 , 46 ( 8 ): 1304 - 1315 .

TIAN Z H , ZHANG Y Z , ZHANG W Z , et al . An adaptive alert correlation method based on pattern mining and clustering analysis [J ] . Journal of Computer Research and Development , 2009 , 46 ( 8 ): 1304 - 1315 .

李冬 , 李之棠 , 雷杰 . 周期性误告警去除方法研究 [J ] . 小型微型计算机系统 , 2009 , 30 ( 7 ): 1336 - 1340 .

LI D , LI Z T , LEI J . Research on the method of reducing false positives with periodicity [J ] . Journal of Chinese Computer Systems , 2009 , 30 ( 7 ): 1336 - 1340 .

王莉 . 网络多步攻击识别方法研究 [D ] . 武汉:华中科技大学 , 2007 .

WANG L . Study on method of network multi-stage attack plan recognition [D ] . Wuhan:Huazhong University of Science and Technology , 2007 .

MIT Lincoln Lab.2000 DARPA intrusion detection scenario specific data sets [EB/OL ] . http://www.ll.mit.edu/ideval/data/2000data.html. http://www.ll.mit.edu/ideval/data/2000data.html. .

Views

4557

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Real-time attack scenario reconstruction method based on incremental alert analysis

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Research on intrusion detection model based on synchronization of heterogenous executer

Personalized lightweight distributed network intrusion detection system in fog computing

Related Author

Cheng Guang

Zhang Song

Zhang Yujian

Chen Shi

Tang Huimin

Zhao Xinjian

HUANG Kai

JIANG Libing

Related Institution

School of Cyber Science and Engineering, Southeast University

Information & Telecommunication Branch, State Grid Jiangsu Electric Power Co., Ltd.

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Mathematics and Computer Sciences, Nanchang University

Songshan Laboratory

⁰