TANDI: threat assessment of network data and information

Abstract

Current practice for combating cyber attacks typically use Intrusion Detection Sensors (IDSs) to passively detect and block multi-stage attacks. This work leverages Level-2 fusion that correlates IDS alerts belonging to the same attacker, and proposes a threat assessment algorithm to predict potential future attacker actions. The algorithm, TANDI, reduces the problem complexity by separating the models of the attacker's capability and opportunity, and fuse the two to determine the attacker's intent. Unlike traditional Bayesian-based approaches, which require assigning a large number of edge probabilities, the proposed Level-3 fusion procedure uses only 4 parameters. TANDI has been implemented and tested with randomly created attack sequences. The results demonstrate that TANDI predicts future attack actions accurately as long as the attack is not part of a coordinated attack and contains no insider threats. In the presence of abnormal attack events, TANDI will alarm the network analyst for further analysis. The attempt to evaluate a threat assessment algorithm via simulation is the first in the literature, and shall open up a new avenue in the area of high level fusion.

The DarkWeb: Cyber-Security Intelligence Gathering Opportunities, Risks and Rewards

“…attack intentions). Contextual information from IDS logs is also used as an input in several studies using a variety of tools for that purpose [14] [15]. The work presented at this section is an extension of our work presented in [16] where both the model and the resulting algorithm are formalised.…”

High level information fusion for tracking and projection of multistage cyber attacks

“…INFERD efficiently correlates IDS alerts to identify individual multistage attacks [12] and provides situational measures of the identified attacks [19]. TANDI fuses information extracted from each attack track estimates, to determine threatened entities and to differentiate them by assigning threat scores [20]. This section illustrates the two fusion engines, starting by providing an overview of the integrated system architecture.…”

“…Section 3 illustrates a proposed high level fusion based cyber defense system, that aims at providing situation, threat and impact assessment of cyber attacks. The system is based upon our work on INformation Fusion Engine for Real-time Decision-making (INFERD) [12,19] and Threat Assessment for Network Data and Information (TANDI) [20,21]. An inside look of INFERD and TANDI, in how they track and project cyber attack actions, is also provided in Section 3.…”

Cyber-Argus: Modeling C2 Impacts of Cyber Attacks

“…The most common approach to develop cyber SA uses an enemy viewpoint approach [16]. In this approach, an Analyst attempts to predict how vulnerabilities can be exploited by the enemy, usually through a database of an enemy's preferences and capabilities [17][18] or an attack graph [19][20][21][22][23][24][25][26][27][28][29][30].…”