Abstract
In the era of global Internet security threats, there is an urgent need for different organizations to cooperate and jointly fight against cyber attacks. We present an algorithm that combines a privacy-preserving technique and a multi-step attack-correlation method to better balance the privacy and availability of alarm data. This algorithm is used to construct multi-step attack scenarios by discovering sequential attack-behavior patterns. It analyzes the time-sequential characteristics of attack behaviors and implements a support-evaluation method. Optimized candidate attack-sequence generation is applied to solve the problem of pre-defined association-rule complexity, as well as expert-knowledge dependency. An enhanced k-anonymity method is applied to this algorithm to preserve privacy. Experimental results indicate that the algorithm has better performance and accuracy for multi-step attack correlation than other methods, and reaches a good balance between efficiency and privacy.
Article PDF
Similar content being viewed by others
Explore related subjects
Discover the latest articles, news and stories from top researchers in related subjects.Avoid common mistakes on your manuscript.
References
ZHANG S, LI J, CHAN X, et al. Building network attack graph for alert causal correlation[J]. Computers & security, 2008, 27(5–6): 188–196.
ZHOU J, HENCHMAN M, REYNOLDS B, et al. Modeling network intrusion detection alerts for correlation[J]. ACM transactions on information and system security, 2007, 10(1): 4–34.
MANGE F. Multistep attack detection and alert correlation in intrusion detection system[J]. Information security and assurance, 2011, 200: 101–110.
NING P, CUI Y, REEVES D S, et al. Techniques and tools for analyzing intrusion alerts[J]. ACM transactions on information and system security, 2014, 7(2): 273–318.
DEBAR H, WISPY A. Aggregation and correlation or intrusion-detection alerts[J]. Lecture notes in computer science, 2011, 2212: 85–98.
MORIN B, DEBAR H. Correlation of intrusion symptoms: an application of chronicles[J]. Lecture notes in computer science, 2013, 2820: 91–112.
WU B. Analysis of alert correlation based on sequential pattern in intrusion detection[J]. Journal of university of electronic science and technology of China, 2009, 3: 38–42.
WANG K, SOLO S J. Privacy-preserving payload-based correlation for accurate malicious traffic detection[C]//The 2006 SIGCOMM Workshop on Large-scale Attack Defense, Pisa, Italy, 2006: 99–106.
RINGER H A. Privacy-preserving collaborative anomaly detection[D]. Princeton: Princeton University, 2009.
KISSNCR L, SONG D. Privacy-preserving set operations [J]. Lecture notes in computer science, 2005, 3621: 231–257.
SRIKANT R, AGRAWAL R. Mining sequential patterns: Generalizations and performance improvements[J]. Lecture notes in computer science, 2012, 1057: 1–17.
YCGNCSWARAN V, BRADFORD P, JHA S. Global intrusion detection in the domino overlay system[R]. University of Wisconsin-Madison Department of Computer Sciences, 2010.
AUGURAL G, FODOR T. Approximation algorithms for k-anonymity[J]. Journal of privacy technology, 2015, 20(1): 12–23.
Author information
Authors and Affiliations
Additional information
This work is supported by the Ordinary University Innovation Project of Guangdong Province (Nos. 2014KTSCX212, 2014KQNCX24).
ZHANG Yongtang [corresponding author]was born in 1981. He earned a Master’s degree in network and communications engineering in 2005 from the Central China Normal University. He is currently working in the Guangdong Neusoft Institute as an associate professor, and as a systems analyst at the Jiangxi Microsoft Technology Center. At present, his main research interests are communications and wireless sensor network applications, network security, and offensive and defensive techniques. (Email: gov211@163.com)
LUO Xianlu was born in 1973. He earned a Master’s degree in computer applications in 2002 from Northeastern University. He is currently working in the Guangdong Neusoft Institute as an associate professor and systems analyst. At present, his main research interests are algorithms, network security, and offensive and defensive techniques. (Email: luoxl@neusoft.com)
LUO Haibo was born in 1980. In 2009, he graduated with a Masters in computer science and computer application engineering from Wuhan University. He is currently in Guangdong Neusoft Institute, as a lecturer. His research interests are information-security research and data mining. (Email: luo-hb@neusoft. com)
Rights and permissions
About this article
Cite this article
Zhang, Y., Luo, X. & Luo, H. A multi-step attack-correlation method with privacy protection. J. Commun. Inf. Netw. 1, 133–142 (2016). https://doi.org/10.1007/BF03391586
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/BF03391586