基于因果知识发现的攻击场景重构研究

樊迪; 刘静; 庄俊玺; 赖英旭

doi:10.11959/j.issn.2096-109x.2017.00148

您当前的位置：

首页 >

文章列表页 >

基于因果知识发现的攻击场景重构研究

学术论文 | 更新时间：2024-06-03

- 基于因果知识发现的攻击场景重构研究
- Research on attack scenario reconstruction method based on causal knowledge discovery
- 网络与信息安全学报 2017年3卷第4期页码：58-68
- 作者机构：
  
  1. 北京工业大学信息学部，北京 100124
  2. 北京工业大学可信计算北京市重点实验室，北京 100124
  3. 北京工业大学信息安全等级保护关键技术国家工程实验室，北京 100124
- 作者简介：
  
  [ "樊迪（1992-），女，山东惠民人，北京工业大学硕士生，主要研究方向为网络安全、日志分析。" ]
  [ "刘静（1978-），女，北京人，北京工业大学讲师，主要研究方向为网络安全、可信计算。" ]
  [ "庄俊玺（1981-），女，河南新乡人，北京工业大学讲师，主要研究方向为网络安全、可信计算。" ]
  [ "赖英旭（1973-），女，辽宁抚顺人，博士，北京工业大学教授，主要研究方向为网络接入控制、病毒防御技术、网络安全工程、可信计算理论及其应用。" ]
- 基金信息：
  
  北京市自然科学基金资助项目;The Natural Science Foundation of Beijing(4162006)
- DOI：10.11959/j.issn.2096-109x.2017.00148
  中图分类号： TP393
- 网络首发：2017-04，
  
  纸质出版：2017-04-15
- 稿件说明：
移动端阅览
樊迪, 刘静, 庄俊玺, 等. 基于因果知识发现的攻击场景重构研究[J]. 网络与信息安全学报, 2017,3(4):58-68.

Di FAN, Jing LIU, Jun-xi ZHUANG, et al. Research on attack scenario reconstruction method based on causal knowledge discovery[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 58-68.
樊迪, 刘静, 庄俊玺, 等. 基于因果知识发现的攻击场景重构研究[J]. 网络与信息安全学报, 2017,3(4):58-68. DOI： 10.11959/j.issn.2096-109x.2017.00148.

Di FAN, Jing LIU, Jun-xi ZHUANG, et al. Research on attack scenario reconstruction method based on causal knowledge discovery[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 58-68. DOI： 10.11959/j.issn.2096-109x.2017.00148.

摘要

为了从分散的告警日志中发现攻击模式、构建攻击场景，通过分析现有攻击场景重构方法，针对现有方法因果知识复杂难懂且难以自动获取的问题，提出一种基于因果知识发现的攻击场景重构方法。所提方法首先按照知识发现的过程，通过告警日志间 IP 属性的相关程度，构建攻击场景的序列集合；然后，采用时间序列建模的方式去除误告警，以精简攻击场景序列；最后，利用概率统计方法发现各告警类型间的关联关系。在DARPA 2000数据集上对方法进行了实验验证，结果表明，该方法能有效识别多步攻击模式。

Abstract

In order to discover the attack pattern from the distributed alert data and construct the attack scene

a method of finding the attack scene from the alert data generated by intrusion detection system was studied.Current research suffer from the problem that causal knowledge is complex and difficult to understand and it is difficult to automatically acquire the problem.An attack scenario reconstruction method based on causal knowledge discovery was proposed.According to the process of KDD

the sequence set of attack scenes was constructed by the correlation degree of IP attributes among alert data.Time series modeling was adopted to eliminate the false positives to reduce the attack scene sequence.Finally

causal relationship between the alert data was found by using probability statistics.Experiments on the DARPA2000 intrusion scenario specific data sets show that the method can effectively identify the multi-step attack mode.

关键词

Keywords

references

国家计算机网络应急技术处理协调中心 . 2015 年中国互联网网络安全报告 [R ] . 2016 .

National Computer Network Emergency Response Coordination Center . The Chinese Internet network security report [R ] . 2016 .

NING P , CUI Y , REEVES D S . Techniques and tools for analyzing intrusion alerts [J ] . ACM Trans on Information and System Security , 2004 , 7 ( 2 ): 274 - 318 .

QIN X , LEE W . Statistical causality analysis of INFOSEC alert data [C ] // The 6th International Symposium on Recent Advances in Intrusion Detection . 2003 : 591 - 627 .

MAGGI F , ZANERO S . On the use of different statistical tests for alert correlation:short paper [C ] // The 10th International Conference on Recent Advances in Intrusion Detection . 2007 : 167 - 177 .

冯学伟 , 王东霞 , 黄敏桓 , 等 . 一种基于马尔可夫性质的因果知识挖掘方法 [J ] . 计算机研究与发展 , 2014 , 51 ( 11 ): 2493 - 2504 .

FENG X W , WANG D X , HUANG M H , et al . A mining approach for causal knowledge in alert correlating based on the Markov property [J ] . Journal of Computer Research and Development , 2014 , 51 ( 11 ): 2493 - 2504 .

FENG X , WANG D , ZENG J , et al . Analyzing and correlating security events using state machine [C ] // IEEE International Conference on Computer and Information Technology . 2010 : 2849 - 2854 .

TEMPLETON S J , LEVITT K . A requires/provides model for computer attacks [C ] // The 2000 Workshop on New Security Paradigms . 2000 : 31 - 38 .

NING P , CUI Y , REEVES D S . Constructing attack scenarios through correlation of intrusion alerts [C ] // The 9th ACM Conference on Computer and Communications Security . 2002 : 245 - 254 .

CUPPENS F , MIEGE A . Alert correlation in a cooperative intrusion detection framework [C ] // The 2002 IEEE Symposium on Security and Privacy . 2002 : 202 - 215 .

CUPPENS F , . Managing alerts in a multi-intrusion detection environment [C ] // The 17th Annual Computer Security Applications Conference . 2001 : 22 - 31 .

CUPPENS F , AUTREL F , MIEGE A , et al . Correlation in an intrusion detection process [C ] // The SECI02 Workshop . 2002 : 153 - 171 .

胡亮 , 解男男 , 努尔布力 , 等 . 基于智能规划的多步攻击场景识别算法 [J ] . 电子学报 , 2013 , 41 ( 9 ): 1753 - 1759 .

HU L , XIE N N , NU E B L , et al . A multi-stage attack scenario recognition algorithm based on intelligent planning [J ] . Acta Electronica Sinica , 2013 , 41 ( 9 ): 1753 - 1759

QIN X , LEE W . Discovering novel attack strategies from INFOSEC alerts [C ] // The 9th European Symposium on Research in Computer Security . 2004 : 439 - 456 .

QIN X , LEE W . Causal discovery-based alert correlation [C ] // The 21st Annual Computer Security Application Conference , 2005 : 33 - 40 .

MORIN B , DEBAR H . Correlation of intrusion symptoms:an application of chronicles [J ] . Lecture Notes in Computer Science , 2003 , 2820 : 94 - 112 .

ZHANG AF , LI Z , LI D , et al . Discovering novel multistage attack patterns in alert streams [C ] // The International Conference on Networking,Architecture,and Storage . 2007 . 115 - 121 .

王泽芳 , 袁平 , 黄晓芳 . 一种新的多步攻击场景重构技术研究 [J ] . 西南科技大学学报 , 2016 , 31 ( 1 ): 55 - 60 .

WANG Z F , YUAN P , HUANG X F . Research of a novel attack scenario constructing method [J ] . Journal of Southwest University and Technology , 2016 , 31 ( 1 ): 55 - 60 .

PIETRASZEKT , TANNER A . Data mining and machine learning-towards reducing false positives in intrusion [J ] . Information Security Technical Report , 2005 , 10 : 169 - 183 .

田志宏 , 张永铮 , 张伟哲 , 等 . 基于模式挖掘和聚类分析的自适应告警关联 [J ] . 计算机研究与发展 , 2009 , 46 ( 8 ): 1304 - 1315 .

TIAN Z H , ZHANG Y Z , ZHANG W Z , et al . An adaptive alert correlation method based on pattern mining and clustering analysis [J ] . Journal of Computer Research and Development , 2009 , 46 ( 8 ): 1304 - 1315 .

李冬 , 李之棠 , 雷杰 . 周期性误告警去除方法研究 [J ] . 小型微型计算机系统 , 2009 , 30 ( 7 ): 1336 - 1340 .

LI D , LI Z T , LEI J . Research on the method of reducing false positives with periodicity [J ] . Journal of Chinese Computer Systems , 2009 , 30 ( 7 ): 1336 - 1340 .

王莉 . 网络多步攻击识别方法研究 [D ] . 武汉:华中科技大学 , 2007 .

WANG L . Study on method of network multi-stage attack plan recognition [D ] . Wuhan:Huazhong University of Science and Technology , 2007 .

MIT Lincoln Lab.2000 DARPA intrusion detection scenario specific data sets [EB/OL ] . http://www.ll.mit.edu/ideval/data/2000data.html. http://www.ll.mit.edu/ideval/data/2000data.html. .

浏览量

4557

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于告警增量分析的攻击场景实时重构方法

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究

基于异构执行体同步控制的入侵检测模型研究

面向雾计算的个性化轻量级分布式网络入侵检测系统