Abstract
In monitoring anomalous network activities, intrusion detection systems tend to generate a large amount of alerts, which greatly increase the workload of post-detection analysis and decision-making. A system to detect the ongoing attacks and predict the upcoming next step of a multistage attack in alert streams by using known attack patterns can effectively solve this problem. The complete, correct and up to date pattern rule of various network attack activities plays an important role in such a system. An approach based on sequential pattern mining technique to discover multistage attack activity patterns is efficient to reduce the labor to construct pattern rules. But in a dynamic network environment where novel attack strategies appear continuously, the novel approach that we propose to use incremental mining algorithm shows better capability to detect recently appeared attack. In order to improve the correctness of results and shorten the running time of the mining algorithms, the directed graph is presented to restrict the scope of data queried in mining phase, which is especially useful in incremental mining. Finally, we remove the unexpected results from mining by computing probabilistic score between successive steps in a multistage attack pattern. A series of experiments show the validity of the methods in this paper.
This is a preview of subscription content, log in via an institution to check access.
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Ning, P., Cui, Y., Reeves, D.S.: Constructing attack scenarios through correlation of intrusion alerts. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, Washington, DC, November 18-22, 2002, pp. 18–22 (2002)
Ning, P., Cui, Y., Reeves, D.S., Xu, D.: Techniques and tools for analyzing intrusion alerts. ACM Transactions on Information and System Security 7, 274 (2004)
Ning, P., Xu, D.: Alert correlation through triggering events and common resources, Tucson, AZ (2004)
Cuppens, F.: Managing alerts in multi-intrusion detection environment. In: Proceedings 17th annual computer security applications conference, New Orleans (2001)
Cuppens, F., Miège, A.: Alert correlation in a cooperative intrusion detection framework. In: Proceedings of the 2002 IEEE symposium on security and privacy, IEEE Computer Society Press, Los Alamitos (2002)
Cuppens, F., Autrel, F., Miège, A., Benferhat, S.: Correlation in an intrusion detection process. In: SECI 2002. Proceedings SÈcuritè des communications sur internet (2002)
Valdes, A., Skinner, K.: Probabilistic alert correlation. In: Lee, W., Mé, L., Wespi, A. (eds.) RAID 2001. LNCS, vol. 2212, Springer, Heidelberg (2001)
Hang, M.Y, Wicks, T.M.: A large-scale distributed intrusion detection framework based on attack strategy analysis. Computer network, 2465–2475 (1999)
Sheyner, O., Haines, J., Jha, S., Lippmann, R., Wing, J.M.: Automated generation and analysis of attack graphs. In: Proceedings of the 2002 IEEE Symposium on Security and Privacy, Oakland, CA (May 2002)
Lee, W., Qin, X.: Statistical Causality Analysis of INFOSEC Alert Data. In: Vigna, G., Krügel, C., Jonsson, E. (eds.) RAID 2003. LNCS, vol. 2820, Springer, Heidelberg (2003)
Qin, X., Lee, W.: Discovering novel attack strategies from INFOSEC alerts. In: Sophia Antipolis, France (2004)
Treinen, J.J., Thurimella, R.: A Framework for the Application of Association Rule Mining in Large Intrusion Detection Infrastructures. In: Zamboni, D., Kruegel, C. (eds.) RAID 2006. LNCS, vol. 4219, pp. 1–18. Springer, Heidelberg (2006)
Mannila, H., Toivonen, H., Verkamo, A.I.: Discovering Frequent Episodes in Sequences. In: KDD 1995. Proceedings of the First International Conference on Knowledge Discovery and Data Mining, Montreal, Canada, pp. 210–215 (1995)
Srikant, R., Agrawal, R.: Mining Sequential Patterns: Generalizations and Performance Improvements. In: KDD 1995. Advances in Database Technology –5th International Conference on Knowledge Discovery and Data Mining, Montreal, Canada, pp. 269–274 (1995)
Agrawal, R., Srikant, R.: Mining sequential patterns. In: Research Report RJ 9910, IBM Almaden Research Center, San Jose, California (October 1994)
Masseglia, F., Poncelet, P., Teisseire, M.: Incremental mining of sequential patterns in large databases. Data Knowledge 46(1), 97–121 (2003)
Lin, M.-Y., Lee, S.-Y.: Incremental Update on Sequential Patterns in Large Databases. In: ICTAI 1998. Proceedings of the 10th IEEE International Conference on Tools with Artificial Intelligence, Taipei, Taiwan, R.O.C, pp. 24–31 (1998)
Wang, L.: Li Z.-t., Fan J.: Learning attack strategies through attack sequence mining method, International Conference on Communication Technology (2006)
MIT Lincoln Lab: DARPA Intrusion Detection Scenario Specific Data Sets (2000), http://www.ll.mit.edu/IST/ideval/data/2000/2000_data_index.html
MIT Lincoln Lab: Tcpdump File Replay Utility. http://ideval.ll.mit.edu/IST/ideval/tools/tools_index.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2007 Springer Berlin Heidelberg
About this paper
Cite this paper
Li, Z., Zhang, A., Li, D., Wang, L. (2007). Discovering Novel Multistage Attack Strategies. In: Alhajj, R., Gao, H., Li, J., Li, X., Zaïane, O.R. (eds) Advanced Data Mining and Applications. ADMA 2007. Lecture Notes in Computer Science(), vol 4632. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-73871-8_6
Download citation
DOI: https://doi.org/10.1007/978-3-540-73871-8_6
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-73870-1
Online ISBN: 978-3-540-73871-8
eBook Packages: Computer ScienceComputer Science (R0)