Big data analysis system concept for detecting unknown attacks

Abstract

Abstract-Recently, threat of previously unknown cyber-attacks are increasing because existing security systems are not able to detect them. Past cyber-attacks had simple purposes of leaking personal information by attacking the PC or destroying the system. However, the goal of recent hacking attacks has changed from leaking information and destruction of services to attacking large-scale systems such as critical infrastructures and state agencies. In the other words, existing defence technologies to counter these attacks are based on pattern matching methods which are very limited. Because of this fact, in the event of new and previously unknown attacks, detection rate becomes very low and false negative increases. To defend against these unknown attacks, which cannot be detected with existing technology, we propose a new model based on big data analysis techniques that can extract information from a variety of sources to detect future attacks. We expect our model to be the basis of the future Advanced Persistent Threat(APT) detection and prevention system implementations.

Data exfiltration: A review of external attack vectors and countermeasures

“…Ahn et al [158] present a model for detecting future unknown Advanced Persistent Threats (APTs) attacks based on analysis of data gathered from various sources. The proposed model consists of four steps: (1) Data collection: data is collected from most of the available resources that includes log files, database, network behaviour, anti-virus, and status information (2) Data processing: collected data is processed to make it meet certain requirements (format and compatibility) (3) Data Analysis: processed data is analysed using clustering, predictions, and behavioural analysis to find out about user behaviour, system status, network traffic and misuse of files (4) Result: if any abnormal behaviour is detected, administrator is alerted about it.…”

Improving Cyber Situational Awareness Through Data Mining and Predictive Analytic Techniques

“…Data mining techniques: Based on literature review, in order to find patterns among the data, data mining techniques will be applied. According to Ahn et al (2014) using classification techniques can help cyber experts to find current patterns and based on findings try to predict the future patterns. Naïve Bayes and decision tree algorithms are two suitable techniques can extract valuable information from uncertain knowledge.…”

“…Type of contained data and type of the task of each node will determine the value them. (Ahn et al 2014) Attack History: this attribute shows which nodes are more likely to be targeted by attackers based on previous observations in terms of cyber breaches. Dut et al (2012) propose an approach to defend against cyber-attacks based on Instance Based Learning Theory (IBLT).…”

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

“…Many papers proposed using big data on security for optimization and unknown attacks detection [17,18], as shown in Fig. 6.…”