A Pattern Matching Based Filter for Audit Reduction and Fast Detection of Potential Intrusions

Kuri, J.; Navarro, Gonzalo; Mé, Ludovic; Heye, Laurent

doi:10.1007/3-540-39945-3_2

Cited by 6 publications

(1 citation statement)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Honeycomb [12] automatically generates attack signatures using a honeypot system and detects these signatures using pattern matching techniques. Josue et al [13] propose a pattern matching algorithm to filter out the audit trail. Koral et al [14] define a set of state transition signatures and detects an attack sequence of the transition.…”

Section: Related Workmentioning

confidence: 99%

Intrusion Detection Based on Spatiotemporal Characterization of Cyberattacks

Kim

2020

Electronics

View full text Add to dashboard Cite

As attack techniques become more sophisticated, detecting new and advanced cyberattacks with traditional intrusion detection techniques based on signature and anomaly is becoming challenging. In signature-based detection, not only do attackers bypass known signatures, but they also exploit unknown vulnerabilities. As the number of new signatures is increasing daily, it is also challenging to scale the detection mechanisms without impacting performance. For anomaly detection, defining normal behaviors is challenging due to today’s complex applications with dynamic features. These complex and dynamic characteristics cause much false positives with a simple outlier detection. In this work, we detect intrusion behaviors by looking at number of computing elements together in time and space, whereas most of existing intrusion detection systems focus on a single element. In order to define the spatiotemporal intrusion patterns, we look at fundamental behaviors of cyberattacks that should appear in any possible attacks. We define these individual behaviors as basic cyberattack action (BCA) and develop a stochastic graph model to represent combination of BCAs in time and space. In addition, we build an intrusion detection system to demonstrate the detection mechanism based on the graph model. We inject numerous known and possible unknown attacks comprising BCAs and show how the system detects these attacks and how to locate the root causes based on the spatiotemporal patterns. The characterization of attacks in spatiotemporal patterns with expected essential behaviors would present a new effective approach to the intrusion detection.

show abstract

Section: Related Workmentioning

confidence: 99%