Discovering Novel Attack Strategies from INFOSEC Alerts

10 years 11 months ago
Discovering Novel Attack Strategies from INFOSEC Alerts
Abstract. Correlating security alerts and discovering attack strategies are important and challenging tasks for security analysts. Recently, there have been several proposed techniques to analyze attack scenarios from security alerts. However, most of these approaches depend on a priori and hard-coded domain knowledge that lead to their limited capabilities of detecting new attack strategies. In this paper, we propose an approach to discover novel attack strategies. Our approach includes two complementary correlation mechanisms based on two hypotheses of attack step relationship. The first hypothesis is that attack steps are directly related because an earlier attack enables or positively affects the later one. For this type of attack relationship, we develop a Bayesian-based correlation engine to correlate attack steps based on security states of systems and networks. The second hypothesis is that for some related attack steps, even though they do not have obvious and direct relation...
Xinzhou Qin, Wenke Lee
Added 01 Jul 2010
Updated 01 Jul 2010
Type Conference
Year 2004
Authors Xinzhou Qin, Wenke Lee
Comments (0)