.png){kind=icon}
返回
Transformer-based framework for alert aggregation and attack prediction in a multi-stage attack
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2023.103533.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
In recent years, the growing threat of cyber attacks has made more researchers focus on the study of alert correlation and attack prediction. While numerous solutions have been proposed, the existing works still have some shortcomings. Without aggregation, previous approaches directly put the excessive and duplicate alerts into models, ignoring the internal logic between adjacent payloads, which we believe is a significant clue to distinguish different types of attacks. In this paper, we propose a similarity based aggregation algorithm to correlate and aggregate alerts, then train a Transformer based model to handle input with variable length and complete the attack prediction. Additionally, a threat estimation method as well as its practical application has been proposed to assess the predicted output. Experimental results demonstrate that our proposed framework has the capability to effectively aggregate alerts, predict different attack intelligence in good mode as well as assess how much threat the administrator would face in the near future.
Keyword:
Alert aggregation
Attack prediction
Transformer
Threat estimation
Intrusion detection
期刊
C
IF:
5.4
论文数:
4.6K
被引数:
1.4W
机构
引用论文
A comprehensive survey of anomaly detection techniques for high dimensional big data高维大数据异常检测技术综述.png)
JOURNAL OF BIG DATA
OAAI
JOURNAL OF BIG DATAIF6.4
OAAI分享收藏
查看更多内容