Loading [a11y]/accessibility-menu.js
Morwilog: an ACO-based system for outlining multi-step attacks | IEEE Conference Publication | IEEE Xplore

Morwilog: an ACO-based system for outlining multi-step attacks


Abstract:

Threat detection is one of the basic mechanisms for protecting a network, as prevention does not suffice. Finding an attack is difficult because the most harmful ones are...Show More

Abstract:

Threat detection is one of the basic mechanisms for protecting a network, as prevention does not suffice. Finding an attack is difficult because the most harmful ones are specially prepared against a specific victim and crafted for the first time. The contribution of a human expert is still needed for their detection, no matter how effective automatic methods used nowadays can appear. Moreover, in many occasions intrusions can only be efficiently detected by analyzing its effects on more than one element in the network. Event and alert recollection offers a way to centralize information from a heterogeneous set of sources. Then, it can be normalized to a common language and analyzed as a whole by a security system. In this paper we propose Morwilog, an ant-inspired method for standing out the relationship between actions belonging to the same complex attack. Morwilog is conceived as a framework for alert correlation to be integrated in a multi-modular security system. Reinforcement learning is incorporated to it thanks to feedback from a human security expert.
Date of Conference: 06-09 December 2016
Date Added to IEEE Xplore: 13 February 2017
ISBN Information:
Conference Location: Athens, Greece

References

References is not available for this document.