• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>European Symposium on Research in Computer Security(ESORICS 2004); 20040913-15; Sophia Antipolis(FR) >Discovering Novel Attack Strategies from INFOSEC Alerts
【24h】

Discovering Novel Attack Strategies from INFOSEC Alerts

机译：从INFOSEC警报中发现新颖的攻击策略

获取原文
获取原文并翻译 | 示例
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Correlating security alerts and discovering attack strategies are important and challenging tasks for security analysts. Recently, there have been several proposed techniques to analyze attack scenarios from security alerts. However, most of these approaches depend on a priori and hard-coded domain knowledge that lead to their limited capabilities of detecting new attack strategies. In this paper, we propose an approach to discover novel attack strategies. Our approach includes two complementary correlation mechanisms based on two hypotheses of attack step relationship. The first hypothesis is that attack steps are directly re-lated because an earlier attack enables or positively affects the later one. For this type of attack relationship, we develop a Bayesian-based correlation engine to correlate attack steps based on security states of systems and networks. The sec-ond hypothesis is that for some related attack steps, even though they do not have obvious and direct relationship in terms of security and performance measures, they still have temporal and statistical patterns. For this category of relationship, we apply time series and statistical analysis to correlate attack steps. The security analysts are presented with aggregated information on attack strategies from these two correlation engines. We evaluate our approach using DARPA's Grand Chal-lenge Problem (GCP) data sets. The results show that our approach can discover novel attack strategies and provide a quantitative analysis of attack scenarios.
机译：对于安全分析师而言，关联安全警报和发现攻击策略是重要且具有挑战性的任务。近来，已经提出了几种提议的技术来分析来自安全警报的攻击情形。但是，这些方法大多数都依赖于先验和硬编码的领域知识，从而导致其检测新攻击策略的能力有限。在本文中，我们提出了一种发现新颖攻击策略的方法。我们的方法包括两个基于攻击步长关系假设的互补相关机制。第一个假设是，攻击步骤直接相关，因为较早的攻击会启用或积极影响较晚的攻击。对于这种类型的攻击关系，我们开发了一种基于贝叶斯的关联引擎，可以根据系统和网络的安全状态来关联攻击步骤。第二个假设是，对于某些相关的攻击步骤，即使它们在安全性和性能指标方面没有明显和直接的关系，它们仍然具有时间和统计模式。对于此类关系，我们应用时间序列和统计分析来关联攻击步骤。向安全分析人员提供了来自这两个相关引擎的有关攻击策略的汇总信息。我们使用DARPA的大Chal-lenge问题（GCP）数据集评估我们的方法。结果表明，我们的方法可以发现新颖的攻击策略并提供对攻击场景的定量分析。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号