An Approach of Discovering Causal Knowledge for Alert Correlating Based on Data Mining

Abstract

The process of attackers exploiting the target facilities is always gradual in cyberspace, and multiple attack steps would be performed in order to achieve the ultimate goal. How to identify the attack scenarios is one of the challenges in many research fields, such as cyberspace security situation awareness, the detection of APT (Advanced Persistent Threat) and so on. Alert correlation analysis based on causal knowledge is one of the widely adopted methods in CEP (Complex Event Processing), which is a promising way to identify multi-step attack processes and can reconstruct attack scenarios. However, current researches suffer from the problem of defining causal knowledge manually. In order to solve this problem, we propose an approach of mining for causal knowledge automatically based on the Markov property in this paper. Firstly, the raw alert stream is clustered into several alert sets, then each set is mined in order to obtain the one step transition probability matrix based on the Markov property, and after being generated, each matrix represents a piece of causal knowledge. Then we fuse the knowledge which has overlapping steps to create the knowledge base of attack patterns. Finally the experimental results show that this approach is feasible.

Analysis framework of network security situational awareness and comparison of implementation methods

“…The knowledge of logic relation, reasoning method, and probability calculation is included in the state transition of directed graph. Attack graph model [5,101,112,128,129], Bayesian model [11,62,114,132], Markov model [53,109,162], and so on all adopt this method. The solution method mainly includes two steps: reachability analysis and quantitative calculation analysis.…”

“…The definition of the model is generally combined with other disciplines, such as Petri network [96,[153][154][155], game theory [108,124,[159][160][161][162], and Bayesian network [114,132], and some articles also focus on the improvement of model description ability [125,126]; the solution algorithm depends on the definition of the model, and it is generally shown together with the solution result. There are lots of literature [109][110][111][112][113][114] trying to improve on this point, such as the reachable path analysis based on attack graph [101,128,129,143,177], defense strategy analysis [111,124,161], and survivability analysis [126].…”

“…According to the statistics and analysis of the existing literature, the quantification of the 3 elements (attack severity, attack occurrence/ success probability, and attack income) has basically formed a certain standard [102,[122][123][124]. On the basis of index system and index quantification, risk assessment algorithm can be developed to get the perception or evaluation result [109,[115][116][117].…”

“…The intention of applying the Markov model to the cybersecurity situational awareness is to predict the attack and defense evolution effectively when the initial conditions are met, but there will be a large number of camouflage attacks or covert attacks during the attack. Forcing the application with inefficiency will lead to the extreme result of statistics (overexaggerating the impact of a certain accident or neglecting the impact of a key step), so Markov is generally combined with other models [53,109,162]. To obtain causal knowledge through Markov's method, and to simplify the operation process by one-step transition probability matrix, the model can be performed efficiently under large-scale networks.…”

Intrusion Alert Correlation to Support Security Management

“…Considering that one attacker performs multiple attack steps to reach its goal, Xuewei et al [16] propose an approach to automatically identify the multistage attacks in intrusion alerts. First, alerts are clustered by related IP addresses using the method of connected components.…”