基于攻击图的多源告警关联分析方法

doi:10.11959/j.issn.1000-436x.2015193

Abstract

Abstract:

Current attack graph-based alert correlation cannot deal with graph relation between alerts properly,and a large number of redundant attack paths may arise when trying to find out missing alerts and predict future attacks.A multi-source alert analyzing method was proposed,fully utilizing graph relation and threshold to correlate mapped alerts and eventually reduce false positive rate as well as true negative rate.To improve the speed of the algorithm,a parallel alert processing system (AG-PAP) was proposed.AG-PAP is tested on distributed environment which gets satisfied effec-tiveness and performance.

Key words: alert correlation, attack graph, multi-source analyzing, parallel processing

Wei-xin LIU,Kang-feng ZHENG,Bin WU,Yi-xian YANG. Alert processing based on attack graph and multi-source analyzing[J]. Journal on Communications, 2015, 36(9): 135-144.

Figures/Tables 11

References 21

[1]	VALEUR F , VIGNA G , KRUEGEL C , et al. A comprehensive ap-proach to intrusion detection alert correlation[J]. IEEE Transactions on Dependable and Secure Computing, 2004,1(3): 146-169.
[2]	ROSCHKE S , CHENG F , MEINEL C . An alert correlation platform for memory-supported techniques[J]. Concurrency and Computa-tion-practice &Experience, 2012,24(10): 1123-1136.
[3]	梅海彬，龚俭，张明华 . 基于警报序列聚类的多步攻击模式发现研究[J]. 通信学报， 2011,32(5): 63-69. MEI HB , GONG J , ZHANG MH . Research on discovering multi-step attack patterns based on clustering IDS alert sequences[J]. Journal on Communications, 2011,32(5): 63-69.
[4]	ROSCHKE S , CHENG F , MEINEL C . Using vulnerability informa-tion and attack graphs for intrusion detection[A]. Information Assur-ance and Security (IAS),2010 Sixth International Conference on IEEE[C]. 2010.68-73.
[5]	NOEL S , JAJODIA S . Advanced vulnerability analysis and intrusion detection through predictive attack graphs[A]. Critical Issues in C4I,Armed Forces Communications and Electronics Association (AFCEA) Solutions Series International Journal of Command and Control[C]. 2009.
[6]	JAJODIA S , NOEL S . Topological Vulnerability Analysis[M]. Springer, 2010.139-154.
[7]	OU X , BOYER W , MCQUEEN M . A scalable approach to attack graph generation[A]. ACM[C]. 2006.336-345.
[8]	GONZALEZ J E , LOW Y , GU H , et al. PowerGraph:distributed graph-parallel computation on natural graphs[A]. OSDI[C]. 2012,12(1): 2.
[9]	WANG L , LIU A , JAJODIA S . Using attack graphs for correlating,hypothesizing,and predicting intrusion alerts[J]. Computer Commu-nications, 2006,29(15): 2917-2933.
[10]	AHMADINEJAD S H , JALILI S , ABADI M . A hybrid model for correlating alerts of known and unknown attack scenarios and up-dating attack graphs[J]. Computer Networks, 2011,55(9): 2221-2240.
[11]	ROSCHKE S , CHENG F , MEINEL C . High-quality attack graph-based IDS correlation[J]. Logic Journal of the Igpl, 2013,21(4I): 571-591.
[12]	ROSCHKE S , CHENG F , MEINEL C . A new alert correlation algo-rithm based on attack graph[J]. Computational Intelligence in Security for Information Systems, 2011,6694:58-67.
[13]	DEAN J , GHEMAWAT S . MapReduce[J]. Communications of the ACM, 2008,51(1): 107.
[14]	LOW Y , BICKSON D , GONZALEZ J , et al. Distributed graphlab:a framework for machine learning and data mining in the cloud[J]. Pro-ceedings of the VLDB Endowment, 2012,5(8): 716-727.
[15]	MALEWICZ G , AUSTERN M H , BIK A J C , et al. Pregel:a system for large-scale graph processing[A]. Proceedings of the 2010 ACM SIGMOD International Conference on Management of data[C]. 2010.
[16]	LI K , GIBSON C , HO D , et al. Assessment of machine learning algo-rithms in cloud computing frameworks[Z]. IEEE, 2013.98-103.
[17]	GUO Y , BICZAK M , VARBANESCU A L , et al. Towards bench-marking graph-processing platforms[A]. The International Conference for High Performance Computing,Networking,Storage and Analy-sis[C]. 2013.
[18]	CHING A , KUNZ C . Giraph:large-scale graph processing infrastruc-ture on Hadoop[J]. Hadoop Summit, 2011,29(6).
[19]	LOW Y , GONZALEZ J , KYROLA A , et al. Graphlab:a new parallel framework for machine learning[A]. UAI[C]. 2010.340-349.
[20]	OU X , GOVINDAVAJHALA S , APPEL A W . MulVAL:a logic- based network security analyzer[A]. 14th USENIX Security[C]. 2005.1-16.
[21]	LOW Y . GraphLab:A Distributed Abstraction for Large Scale Ma-chine Learning[D]. University of California, 2013.

Metrics

Recommended 0

No Suggested Reading articles found!

方法	攻击数	映射告警	输出告警	漏报数	误报数
Wang	8	3	14	0	6
Seyed(HT=3)	8	3	7	2	1
本文(ITH=3)	8	3	11	0	3

方法	告警数	总时间/ms	映射时间/ms	关联分析时间/ms
本文	50 480	1 187	21	1 166
Sebastian^[11]	43 485	52 617	108	52 509.5

方法	大规模图规模处理能力	实时图更新能力	分布式性能	关联预测
Wang[9]	弱	无	无	中
Seyed[10]	无	无	无	中
Roschke[11]	中	弱	中	弱
本文	强	强	强	强

Alert processing based on attack graph and multi-source analyzing

RichHTML

PDF

Knowledge

Cited

Abstract

Cite this article

share this article

Figures/Tables 11

References 21

Related Articles 15

Metrics

Recommended 0

[1]	Zhiyong LUO, Yu ZHANG, Qing WANG, Weiwei SONG. Study of SDN intrusion intent identification algorithm based on Bayesian attack graph [J]. Journal on Communications, 2023, 44(4): 216-225.
[2]	Haiyan KANG, Molan LONG. Research on network attack analysis method based on attack graph of absorbing Markov chain [J]. Journal on Communications, 2023, 44(2): 122-135.
[3]	Hongyu YANG, Haihang YUAN, Liang ZHANG. Host security assessment method based on attack graph [J]. Journal on Communications, 2022, 43(2): 89-99.
[4]	Wenjuan WANG, Xuehui DU, Dibin SHAN. Construction method of attack scenario in cloud environment based on dynamic probabilistic attack graph [J]. Journal on Communications, 2021, 42(1): 1-17.
[5]	Zhiyong LUO,Xu YANG,Jiahui LIU,Rui XU. Network intrusion intention analysis model based on Bayesian attack graph [J]. Journal on Communications, 2020, 41(9): 160-169.
[6]	Li LI,Guozhen SHI,Kui GENG,Xiuze DONG,Fenghua LI. Scheduling algorithm for stochastic job stream cipher service based on load balancing [J]. Journal on Communications, 2018, 39(6): 11-19.
[7]	Zi-wei YE,Yuan-bo GUO,Chen-dong WANG,An-kang JU. Survey on application of attack graph technology [J]. Journal on Communications, 2017, 38(11): 121-132.
[8]	Hao HU,Run-guo YE,Hong-qi ZHANG,Ying-jie YANG,Yu-ling LIU. Quantitative method for network security situation based on attack prediction [J]. Journal on Communications, 2017, 38(10): 122-134.
[9]	Guang-sheng ZHAO,Qing-feng CHENG,Yong-lin SUN. Minimum-cost network hardening algorithm based on stochastic loose optimize strategy [J]. Journal on Communications, 2015, 36(1): 237-245.
[10]	Hai-bin MEI,Jian GONG,Ming-hua ZHANG. Research on discovering multi-step attack patterns based on clustering IDS alert sequences [J]. Journal on Communications, 2011, 32(5): 63-69.
[11]	Yun YE,Xi-shan XU,Yan JIA,Zhi-chang QI,Wen-cong CHENG. Research on the risk adjacency matrix based on attack graphs [J]. Journal on Communications, 2011, 32(5): 112-120.
[12]	Hai-bin MEI,Jian GONG. Research on alert correlation method based on alert confidence in multi-IDS environment [J]. Journal on Communications, 2011, 32(4): 138-146.
[13]	Kai ZHAO,Yi ZHANG,Ben LAI,Xiao-xing LI. Attack graph generation algorithm for large-scale network based on parallel [J]. Journal on Communications, 2011, 32(11A): 125-131.
[14]	Da-peng MAN,Yuan ZHOU,Wu YANG,Yong-tian YANG. Method to generate attack graphs for assessing the overall security of networks [J]. Journal on Communications, 2009, 30(3): 1-5.
[15]	Jia-quan SI,Bing ZHANG,Da-peng MAN,Wu YANG. Approach to making strategies for network security enhancement based on attack graphs [J]. Journal on Communications, 2009, 30(2): 125-130.