Skip to main content
SpringerLink
Log in

Fast attack detection system using log analysis and attack tree generation

  • Published:
Cluster Computing Aims and scope Submit manuscript

Abstract

Many government branches report that internal networks are managed safely by separating them from the outside, but there is often a vulnerability that allows malicious codes to attack an internal network. Recently, the Ministry of National Defense of Korea announced that the internal network operated by the Korean military was attacked though hacking. It is difficult to detect cyber-attacks in real time within an internal network, which can be connected to an Internet of Everything (IoE). In this paper, we propose a fast attack detection system for the internal network that can be used by the government or public organizations. This system generates a tree to which the attack level is applied, notifies the user when the level is reached, and can block the system before an attack. Using this system, it is possible to protect the data and physical aspects by preventing the destruction of a system with large amounts of data, including important confidential or intellectual property. The proposed method offers a proper methodology for designing a malware protection system by categorizing the problem into a tree structure.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9

Similar content being viewed by others

References

  1. Lee, Y.H., Yoo, S.J.: The construction of logical, physical network separation by virtualization. Korea Converg. Secur. Assoc. 14(2), 25–33 (2014)

    Google Scholar 

  2. Lee, M.G.: A study for national cyber security and defense. Korea Contents Soc. 11(4), 18–22 (2013)

    Google Scholar 

  3. Chen, Y., Nyemba, S., Zhang, W., Malin, B.: Specializing network analysis to detect anomalous insider actions. Secur. Inform. 1, 5 (2012)

    Article  Google Scholar 

  4. Zuech, R., Khoshgoftaar, T.M., Walt, R.: Intrusion detection and big heterogeneous data: a survey. J. Big Data 2, 3 (2015)

    Article  Google Scholar 

  5. Yan, J., Govindarasu, M., Chen-Ching, L.I., Ming, N.I., Vaidya, U.: Risk assessment framework for power control systems with PMU-based intrusion response system. J. Mod. Power Syst. Clean Energy 3(3), 321–331 (2015)

    Article  Google Scholar 

  6. Kar, J., Mishra, M.R.: Mitigating threats and security metrics in cloud computing. J. Inf. Process. Syst. 12(2), 226–233 (2016)

    Google Scholar 

  7. StiaWan, D., Idris, M., Abdullah, A.H.: Penetration testing and network auditing: Linux. J. Inf. Process. Syst. 11(1), 104–115 (2015)

    Google Scholar 

  8. Dick, S.: Designing the new Intranet, Ph.D. dissertation, Göteborg University. http://hdl.handle.net/2077/911 (2002)

  9. Alharbi, T., Durando, D., Pakzad, F., Portmann, M.: Securing ARP in software defined networks. In: IEEE 41st Conference on Local Computer Networks (LCN), pp. 523–526 (2016)

  10. Elham, S., Arastouie, N.: Backdoor detection system using artificial neural network and genetic algorithm. In: 2011 International Conference on Computational and Information Sciences (ICCIS), pp. 817–820 (2011)

  11. Schneier, B.: Attack trees. Dr. Dobb’s J. 24(12), 21–29 (1999)

    Google Scholar 

  12. Mark, M., Cassandra, M.T., Cynthia, K.V., John, M., Mark, H., Scott, M., Jason, F.: Cyber threat metrics. Sandia National Laboratories (2012)

  13. Joo, J.W., Moon, S.Y., Singh, S.: S-Detector: an enhanced security model for detecting Smishing attack for mobile computing. Telecommun. Syst. 66(1), 29–38 (2017)

    Article  Google Scholar 

  14. Choi, J., Choi, C., Ko, B., Kim, P.: A method of DDoS attack detection using HTTP packet pattern and rule engine in cloud computing environment. Soft. Comput. 18(9), 1697–1703 (2014)

    Article  Google Scholar 

  15. Betts, M., Stirland, J., Olajide, F., Jones, K., Janicke, H.: Developing a state of the art methodology & toolkit for ICS SCADA forensics. Int. J. Ind. Control Syst. Secur. (IJICSS) 1(2), 44–56 (2016)

    Google Scholar 

Download references

Acknowledgements

This work was supported by Defense Acquisition Program Administration and Agency for Defense Development under the contract (UD160066BD).

Author information

Authors and Affiliations

  1. Department of Computer Engineering, Sejong University, 98 Gunja-Dong, Gwangjin-Gu, Seoul, 143-747, South Korea

    Duhoe Kim, Dongil Shin & Dongkyoo Shin

  2. Agency for Defense Development, Daejeon, Korea

    Yong-Hyun Kim

Authors
  1. Duhoe Kim
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yong-Hyun Kim
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Dongil Shin
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Dongkyoo Shin
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Dongkyoo Shin.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Kim, D., Kim, YH., Shin, D. et al. Fast attack detection system using log analysis and attack tree generation. Cluster Comput 22 (Suppl 1), 1827–1835 (2019). https://doi.org/10.1007/s10586-018-2269-x

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10586-018-2269-x

Keywords

Search

Navigation