.png){kind=icon}
Return
Alert-Driven Attack Graph Generation Using S-PDFA
.png){kind=icon}
OA
AI
DOI：10.1109/TDSC.2021.3117348.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Ideal cyber threat intelligence (CTI) includes insights into attacker strategies that are specific to a network under observation. Such CTI currently requires extensive expert input for obtaining, assessing, and correlating system vulnerabilities into a graphical representation, often referred to as an attack graph (AG). Instead of deriving AGs based on system vulnerabilities, this work advocates the direct use of intrusion alerts. We propose SAGE, an explainable sequence learning pipeline that automatically constructs AGs from intrusion alerts without a priori expert knowledge. SAGE exploits the temporal and probabilistic dependence between alerts in a suffix-based probabilistic deterministic finite automaton (S-PDFA) - a model that brings infrequent severe alerts into the spotlight and summarizes paths leading to them. Attack graphs are extracted from the model on a per-victim, per-objective basis. SAGE is thoroughly evaluated on three open-source intrusion alert datasets collected through security testing competitions in order to analyze distributed multi-stage attacks. SAGE compresses over 330k alerts into 93 AGs that show how specific attacks transpired. The AGs are succinct, interpretable, and provide directly relevant insights into strategic differences and fingerprintable paths. They even show that attackers tend to follow shorter paths after they have discovered a longer one in 84.5% of the cases.
Keywords:
Security
Pipelines
Probabilistic logic
Learning automata
Testing
Special issues and sections
Markov processes
Alert-driven attack graphs
explainable machine learning
suffix automaton model
attacker strategy
intrusion alerts
Journal
IF:
7.5
Papers:
2.5K
Citations:
9.6K
Organization
Cited Papers
ShareSaveShareSaveShareSaveShareSavePositive Effects of Elevated Platforms and Straw Bales on the Welfare of Fast-Growing Broiler Chickens Reared at Two Different Stocking Densities.png)
AnimalsOAAI
AnimalsIF0
OAAIShareSave
View more