Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition have been proposed. However, most of these techniques mainly focus on the alerts of ...Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition have been proposed. However, most of these techniques mainly focus on the alerts of an intrusion detection system and use algorithms of low efficiency that mine frequent attack patterns without reconstructing attack paths. In this paper, a novel and effective method is proposed, which integrates several techniques to identify attack intentions. Using this method, a Bayesian-based attack scenario is constructed, where frequent attack patterns are identified using an efficient data-mining algorithm based on frequent patterns. Subsequently, attack paths are rebuilt by recorrelating frequent attack patterns mined in the scenario. The experimental results demonstrate the capability of our method in rebuilding attack paths, recognizing attack intentions as well as in saving system resources. Specifically, to the best of our knowledge, the proposed method is the first to correlate complementary intrusion evidence with frequent pattern mining techniques based on the FP-Growth algorithm to rebuild attack paths and to recognize attack intentions.展开更多
网络空间中网络攻击形式、持续时间及攻击数据量等不断增加,设备及应用面临巨大安全威胁。但传统的安全防护和检测技术不能很好地解决上述网络安全问题。基于任何形式的网络攻击其最终目标都是网络中的实体,所以从这些终端实体上进行攻...网络空间中网络攻击形式、持续时间及攻击数据量等不断增加,设备及应用面临巨大安全威胁。但传统的安全防护和检测技术不能很好地解决上述网络安全问题。基于任何形式的网络攻击其最终目标都是网络中的实体,所以从这些终端实体上进行攻击分析能够反映网络攻击整体情况。文章提出一种基于主机系统调用实现面向主机的攻击检测和攻击意图识别的方法,该方法基于ETW(Event Tracing for Windows),使用Process Monitor工具获取系统操作行为数据,并结合自定义的高危动作特征,采用自动分析方法,生成系统行为调用图以及统计操作行为特征。能刻画出攻击对主机的一系列危害行为,并通过进一步分析操作行为特征,识别出具体的攻击意图。展开更多
文摘Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition have been proposed. However, most of these techniques mainly focus on the alerts of an intrusion detection system and use algorithms of low efficiency that mine frequent attack patterns without reconstructing attack paths. In this paper, a novel and effective method is proposed, which integrates several techniques to identify attack intentions. Using this method, a Bayesian-based attack scenario is constructed, where frequent attack patterns are identified using an efficient data-mining algorithm based on frequent patterns. Subsequently, attack paths are rebuilt by recorrelating frequent attack patterns mined in the scenario. The experimental results demonstrate the capability of our method in rebuilding attack paths, recognizing attack intentions as well as in saving system resources. Specifically, to the best of our knowledge, the proposed method is the first to correlate complementary intrusion evidence with frequent pattern mining techniques based on the FP-Growth algorithm to rebuild attack paths and to recognize attack intentions.
文摘网络空间中网络攻击形式、持续时间及攻击数据量等不断增加,设备及应用面临巨大安全威胁。但传统的安全防护和检测技术不能很好地解决上述网络安全问题。基于任何形式的网络攻击其最终目标都是网络中的实体,所以从这些终端实体上进行攻击分析能够反映网络攻击整体情况。文章提出一种基于主机系统调用实现面向主机的攻击检测和攻击意图识别的方法,该方法基于ETW(Event Tracing for Windows),使用Process Monitor工具获取系统操作行为数据,并结合自定义的高危动作特征,采用自动分析方法,生成系统行为调用图以及统计操作行为特征。能刻画出攻击对主机的一系列危害行为,并通过进一步分析操作行为特征,识别出具体的攻击意图。
