.png){kind=icon}
返回
Alert-Driven Attack Graph Generation Using S-PDFA
.png){kind=icon}
OA
AI
DOI：10.1109/TDSC.2021.3117348.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Ideal cyber threat intelligence (CTI) includes insights into attacker strategies that are specific to a network under observation. Such CTI currently requires extensive expert input for obtaining, assessing, and correlating system vulnerabilities into a graphical representation, often referred to as an attack graph (AG). Instead of deriving AGs based on system vulnerabilities, this work advocates the direct use of intrusion alerts. We propose SAGE, an explainable sequence learning pipeline that automatically constructs AGs from intrusion alerts without a priori expert knowledge. SAGE exploits the temporal and probabilistic dependence between alerts in a suffix-based probabilistic deterministic finite automaton (S-PDFA) - a model that brings infrequent severe alerts into the spotlight and summarizes paths leading to them. Attack graphs are extracted from the model on a per-victim, per-objective basis. SAGE is thoroughly evaluated on three open-source intrusion alert datasets collected through security testing competitions in order to analyze distributed multi-stage attacks. SAGE compresses over 330k alerts into 93 AGs that show how specific attacks transpired. The AGs are succinct, interpretable, and provide directly relevant insights into strategic differences and fingerprintable paths. They even show that attackers tend to follow shorter paths after they have discovered a longer one in 84.5% of the cases.
Keyword:
Security
Pipelines
Probabilistic logic
Learning automata
Testing
Special issues and sections
Markov processes
Alert-driven attack graphs
explainable machine learning
suffix automaton model
attacker strategy
intrusion alerts
期刊
IF:
7.5
论文数:
2.5K
被引数:
9.6K
机构
引用论文
分享收藏Preliminary Study on the Role Played by the Third Liquid Phase in Phase Transfer Catalysis第三液相在相转移催化中作用的初步研究
PREAI
分享收藏Positive Effects of Elevated Platforms and Straw Bales on the Welfare of Fast-Growing Broiler Chickens Reared at Two Different Stocking Densities.png)
AnimalsOAAI
AnimalsIF0
OAAI分享收藏
查看更多内容