.png){kind=icon}
返回
Attack scenario reconstruction using intrusion semantics
.png){kind=icon}
PRE
AI
DOI：10.1016/j.eswa.2018.04.030.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Security information and event management (SIEM) systems receive a large number of alerts from different intrusion detection systems. They are expected, from these alerts, to make reliable and timely decisions regarding the types of ongoing attack scenarios and their priorities. However, the lack of an agreed-upon vocabulary for the representation of the domain knowledge makes it difficult for state-of-the-art SIEM systems to effectively manage these complex decisions. To overcome this problem, an ontology-based expert system approach can provide domain knowledge modeling as a foundation for disambiguation of meaning and automatic reasoning regarding ongoing attack scenarios. The proposed approach reconstructs attack scenarios by reasoning based on the evidences in the alert stream. The main idea of the proposed approach is to identify the causal relation between alerts using their similarity. This approach assumes that the similarity between two successive steps in an attack scenario is greater than that of two non-successive steps. Moreover, the similarity between the steps of the same attack scenario is greater than that between the steps of two different attack scenarios. The benefit of the proposed approach includes the fast and incremental reconstruction of known and unknown attack scenarios without expert intervention, which is an enormous step forward in developing expert and intelligent systems for cyber security. We evaluated the proposed technique by performing experiments on two known datasets: DARPA 2000 and MACCDC 2012. The results prove the advantages of the proposed approach with regard to completeness and soundness criteria. (C) 2018 Elsevier Ltd. All rights reserved.
Keyword:
Alert correlation
Attack scenario
Ontology
Similarity
Semantic
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
7.5
论文数:
2.9W
被引数:
10.2W
机构
引用论文
A logic-based model to support alert correlation in intrusion detection.png)
INFORMATION FUSION
INFORMATION FUSIONIF15.5
PREAI
分享收藏Intrusion alert prioritisation and attack detection using post-correlation analysisCOMPUTERS & SECURITY
OAAI
COMPUTERS & SECURITYIF5.4
OAAI分享收藏A note on approximations and convergence in distribution for spearman's rank correlation coefficient
PREAI
分享收藏Carboxymethylcellulose coated on visceral face of polypropylene mesh prevents adhesion without impairing wound healing in incisional hernia model in ratsHernia
HerniaIF0
PREAI
分享收藏
查看更多内容