Detection and Modeling of Cyber Attacks with Petri Nets

Abstract

The aim of this article is to present an approach to develop and verify a method of formal modeling of cyber threats directed at computer systems. Moreover, the goal is to prove that the method enables one to create models resembling the behavior of malware that support the detection process of selected cyber attacks and facilitate the application of countermeasures. The most common cyber threats targeting end users and terminals are caused by malicious software, called malware. The malware detection process can be performed either by matching their digital signatures or analyzing their behavioral models. As the obfuscation techniques make the malware almost undetectable, the classic signature-based anti-virus tools must be supported with behavioral analysis. The proposed approach to modeling of malware behavior is based on colored Petri nets. This article is addressed to cyber defense researchers, security architects and developers solving up-to-date problems regarding the detection and prevention of advanced persistent threats.

An Entropy-Based Network Anomaly Detection Method

“…Currently Anode is also a component of the anomaly detection and security event data correlation system developed in SECOR project [100]. A final implementation in SECOR has been developed in JAVA WSO2 (http://wso2.com) environment.…”

Design of adaptive system of detection of cyber-attacks, based on the model of logical procedures and the coverage matrices of features

“…[22] considers the possibility of application of MAR splines in ASDCA, enabling building of exact approximation of the behavior of a standard user, or of the attacking side, according to specified parameters. A large number of works is devoted to statistical analysis of the data in ASDCA [15,23], to signature models [24] and theoretical aspects of the use of Markov chains [5,6,24] and the Petri nets [25] for the systems of cyber-attacks recognition.…”

Extracting of temporal patterns from data for hierarchical classifiers construction

“…Signatures describe illegal patterns in network traffic and require expert knowledge about the given network threat given a priori. Such solutions do not cope with slightly modified or so-called 0-days attacks [6]. Another group of anomaly detection methods is based on entropy analysis [7], [8], [9].…”