Towards Predicting Cyber Attacks Using Information Exchange and Data Mining

Warning

This publication doesn't include Faculty of Economics and Administration. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

HUSÁK Martin KAŠPAR Jaroslav

Year of publication 2018
Type Article in Proceedings
Conference 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC)
MU Faculty or unit

Institute of Computer Science

Citation
Web https://ieeexplore.ieee.org/document/8450512/
Doi http://dx.doi.org/10.1109/IWCMC.2018.8450512
Keywords attack prediction;collaborative security;information exchange;data mining
Attached files
Description In this paper, we present an empirical evaluation of an approach to predict attacker's activities based on information exchange and data mining. We gathered the cyber security alerts shared within the SABU platform, in which around 220,000 alerts from heterogeneous geographically distributed sensors (intrusion detection systems and honeypots) are shared every day. Subsequently, we used the methods of sequential rule mining to identify common attack patterns and to derive rules for predicting attacks. As we illustrate in this paper, a collaborative environment allows attack prediction in multiple dimensions. First, we can predict what will the attacker do next and when. Second, we can predict where will the attack hit, e.g., when an attacker is targeting several networks at once. In a week-long experiment, we processed in total over 1 million alerts, from which we mined predictive rules every day. Our findings show that most of the rules display stable values of support and confidence and, thus, can be used to predict cyber attacks in consecutive days after mining without a need to actualize the rules every day.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.