Skip to main content
SpringerLink
Log in

Cyber situational awareness through network anomaly detection: state of the art and new approaches

Cyber-Lagebildverständnis mittels Netzwerk-Anomalieerkennung: Stand der Technik und neuartige Ansätze

  • Originalarbeiten
  • Published:
e & i Elektrotechnik und Informationstechnik Aims and scope Submit manuscript

Abstract

With a major change in the attack landscape, away from well-known attack vectors towards unique and highly tailored attacks, limitations of common rule- and signature-based security systems become more and more obvious. Novel security mechanisms can provide the means to extend existing solutions in order to provide a more sophisticated security approach. As critical infrastructures get increasingly accessible from public networks they show up on attackers’ radars. As a consequence, establishing cyber situational awareness on a higher level through incident information sharing is vital for assessing the increased risk to national security in the cyber space. But legal obligations and economical considerations limit the motivation of companies to pursue information sharing initiatives. To support companies and governmental initiatives, novel security mechanisms should inherently address limiting factors. One novel approach, AECID, is presented that accounts for the limitations of many common intrusion and anomaly detection mechanisms; and which further provides the features to support privacy-aware information sharing for cyber situational awareness.

Zusammenfassung

Mit der nachhaltigen Änderung heutiger Angriffsmethoden, weg von gut bekannten Attacken Richtung individueller und hoch-spezialisierter Angriffe, werden die Beschränkungen gewöhnlicher Regel- und Signatur-basierter IT-Sicherheitssysteme mehr und mehr sichtbar. Neuartige Sicherheitsmechanismen haben das Potential, bestehende Lösungen diesbezüglich wesentlich zu verbessern und somit einen weitreichenderen Sicherheitsansatz zu bieten. Da kritische Infrastrukturen zunehmend auch aus öffentlichen Netzen zugänglich werden, werden sie auch vermehrt für Angreifer zu attraktiven Zielen. Als Konsequenz ist die Etablierung eines Cyber-Lagebildes auf höherer Ebene auf Basis geteilter Informationen über Cyber-Zwischenfälle entscheidend für die Beurteilung der erhöhten Gefahr für die nationale Sicherheit im Cyberspace. Aber gesetzliche Verpflichtungen und wirtschaftliche Überlegungen beschränken die Motivation von Organisationen, einen Sicherheits-kritischen Informationsaustausch voranzutreiben. Um nun Unternehmen und Regierungsinitiativen zu unterstützen, sollten neue Sicherheitsmechanismen die Faktoren, welche die Akzeptanz von Systemen für den Informationsaustausch limitieren, gezielt kompensieren. Ein neuartiger Ansatz, AECID, welcher hierbei zur Anwendung kommen könnte, wird in diesem Artikel vorgestellt. AECID berücksichtigt die angesprochenen Beschränkungen vieler gängiger Anomalie-Erkennungssysteme und unterstützt darüber hinaus jene Eigenschaften, die für einen Datenschutz-konformen Informationsaustausch zum Aufbau eines allgemeinen Lagebildverständnisses erforderlich sind.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1.
Listing 1.

Similar content being viewed by others

References

  1. Bartoš, V., Žádník, M. (2012): Network anomaly detection: comparison and real-time issues. In Dependable networks and services (pp. 118–121). Berlin: Springer.

    Chapter  Google Scholar 

  2. Binsalleeh, H., Ormerod, T., Boukhtouta, A., Sinha, P., Youssef, A., Debbabi, M., Wang, L. (2010): On the analysis of the zeus botnet crimeware toolkit. In 2010 Eighth annual international conference on privacy security and trust (PST) (pp. 31–38). New York: IEEE Press.

    Chapter  Google Scholar 

  3. Chandola, V., Banerjee, A., Kumar, V. (2009): Anomaly detection: a survey. ACM Comput. Surv. (CSUR), 41(3), 15.

    Article  Google Scholar 

  4. Endsley, M. R. (1995): Toward a theory of situation awareness in dynamic systems. Hum. Factors, 37(1), 32–64.

    Article  Google Scholar 

  5. European Commission (2013): Commission proposal for a directive concerning measures to ensure a high common level of network and information security across the union. http://ec.europa.eu/digital-agenda/en/news/commission-proposal-directive-concerning-measures-ensure-high-common-level-network-and.

  6. Fracker, M. L. (1991): Measures of situation awareness: review and future directions. Technical Report AL-TR-1991-0128, Wright-Patterson Air Force Base.

  7. Friedberg, I., Skopik, F., Settanni, G., Fiedler, R. (2015): Combating advanced persistent threats: from network event correlation to incident detection. Comput. Secur., 48, 35–57.

    Article  Google Scholar 

  8. Hernandez-Ardieta, J. L., Tapiador, J. E., Suarez-Tangil, G. (2013): Information sharing models for cooperative cyber defence. In Cyber conflict (pp. 1–28).

    Google Scholar 

  9. ISO (2012-03-20): Iso/iec27010: Info. tech.: security techniques—information security management for inter-sector and inter-organizational communications.

  10. ITU-T (2012): Recommendation itu-t x. 1500 cybersecurity info. exchange tech.

  11. Jajodia, S., Liu, P., Swarup, V., Wang, C. (2009): Cyber situational awareness: issues and research. Berlin: Springer.

    Google Scholar 

  12. Li, G., Japkowicz, N., Yang, L. (2012): Anomaly detection via coupled Gaussian kernels. In Advances in artificial intelligence (pp. 343–349). Berlin: Springer.

    Chapter  Google Scholar 

  13. NIST (2014-02-12): Framework for improving critical infrastructure cybersecurity.

  14. Sabahi, F., Movaghar, A. (2008): Intrusion detection: a survey. In 3rd international conference on systems and networks communications, 2008, ICSNC’08 (pp. 23–26). New York: IEEE Press.

    Google Scholar 

  15. Sarter, N. D., Woods, D. D. (1991): Situation awareness: a critical but ill-defined phenomenon. Int. J. Aviat. Psychol., 1, 45–57.

    Article  Google Scholar 

  16. Thottan, M., Ji, C. (2003): Anomaly detection in ip networks. IEEE Trans. Signal Process., 51(8), 2191–2204.

    Article  Google Scholar 

  17. Yin, J., Zhang, G., Chen, Y.-Q., Fan, X.-L. (2004): Multi-events analysis for anomaly intrusion detection. In Proceedings of 2004 international conference on machine learning and cybernetics, 2004 (Vol. 2, pp. 1298–1303). New York: IEEE Press.

    Google Scholar 

  18. Yu, Y. (2012): A survey of anomaly intrusion detection techniques. J. Comput. Sci. Coll., 28(1), 9–17.

    Google Scholar 

  19. Zhang, W., Yang, Q., Geng, Y. (2009): A survey of anomaly detection methods in networks. In International symposium on computer network and multimedia technology, 2009, CNMT 2009 (pp. 1–3). New York: IEEE Press.

    Google Scholar 

  20. Zhang, Y.-l., Han, Z.-g., Ren, J.-x. (2009): A network anomaly detection method based on relative entropy theory. In Second international symposium on electronic commerce and security, 2009, ISECS’09 (Vol. 1, pp. 231–235). New York: IEEE Press.

    Chapter  Google Scholar 

  21. Zhao, Y., Zheng, Z., Wen, H. (2010): Bayesian statistical inference in machine learning anomaly detection. In 2010 International conference on communications and intelligence information security (ICCIIS) (pp. 113–116). New York: IEEE Press.

    Chapter  Google Scholar 

Download references

Acknowledgements

This work was partly funded by the Austrian FFG research program KIRAS in course of the project CIIS (840842) and the European Union FP7 project ECOSSIAN (607577).

Author information

Authors and Affiliations

  1. Digital Safety & Security Department, AIT Austrian Institute of Technology, Donau-City-Straße 1, 1220, Vienna, Austria

    Ivo Friedberg, Florian Skopik & Roman Fiedler

Authors
  1. Ivo Friedberg
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Florian Skopik
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Roman Fiedler
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ivo Friedberg.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Friedberg, I., Skopik, F. & Fiedler, R. Cyber situational awareness through network anomaly detection: state of the art and new approaches. Elektrotech. Inftech. 132, 101–105 (2015). https://doi.org/10.1007/s00502-015-0287-4

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00502-015-0287-4

Keywords

Schlüsselwörter

Search

Navigation