On the Sequential Pattern and Rule Mining in the Analysis of Cyber Security Alerts

Warning

This publication doesn't include Faculty of Economics and Administration. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

HUSÁK Martin KAŠPAR Jaroslav BOU-HARB Elias ČELEDA Pavel

Year of publication 2017
Type Article in Proceedings
Conference Proceedings of the 12th International Conference on Availability, Reliability and Security
MU Faculty or unit

Institute of Computer Science

Citation
Web https://dl.acm.org/citation.cfm?doid=3098954.3098981
Doi http://dx.doi.org/10.1145/3098954.3098981
Field Informatics
Keywords data mining;cyber security;sequential pattern mining;sequential rule mining;alert correlation;attack prediction
Attached files
Description Data mining is well-known for its ability to extract concealed and indistinct patterns in the data, which is a common task in the field of cyber security. However, data mining is not always used to its full potential among cyber security community. In this paper, we discuss usability of sequential pattern and rule mining, a subset of data mining methods, in an analysis of cyber security alerts. First, we survey the use case of data mining, namely alert correlation and attack prediction. Subsequently, we evaluate sequential pattern and rule mining methods to find the one that is both fast and provides valuable results while dealing with the peculiarities of security alerts. An experiment was performed using the dataset of real alerts from an alert sharing platform. Finally, we present lessons learned from the experiment and a comparison of the selected methods based on their performance and soundness of the results.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.