Abstract:With the continuous development of network technology, various large-scale cyber-attacks continue to emerge. These attacks pose a severe threat to the security of systems, networks, and data. Therefore, how to mine attack patterns from massive data and detect attacks are urgent problems. In this paper, an approach for attack mining and detection is proposed that performs tasks of alarm correlation, false-positive elimination, attack mining, and attack prediction. Based on the idea of CluStream, the proposed approach implements a flow clustering method and a two-step algorithm that guarantees efficient streaming and clustering. The context of an alarm in the attack chain is analyzed and the LightGBM method is used to perform false-positive recognition with high accuracy. To accelerate the search for the filtered alarm sequence data to mine attack patterns, the PrefixSpan algorithm is also updated in the store strategy. The updated PrefixSpan increases the processing efficiency and achieves a better result than the original one in experiments. With Bayesian theory, the transition probability for the sequence pattern string is calculated and the alarm transition probability table constructed to draw the attack graph. Finally, a long-short-term memory network and embedding word-vector method are used to perform online prediction. Results of numerical experiments show that the method proposed in this paper has a strong practical value for attack detection and prediction.

A Data Mining Approach to Generating Network Attack Graph for Intrusion Prediction

Using Network Attack Graph to Predict the Future Attacks

A Multi-Step Attack Pattern Discovery Method Based on Graph Mining

Learning attack strategies through mining and correlation of security alarms

Discovering Novel Multistage Attack Strategies

Assessing Attack Threat by the Probability of Following Attacks

Intrusion detection based on graph-directed analytics of the big data

Attack Graph Analysis for Network Anti-Forensics.

Generating Network Attack Graphs for Security Alert Correlation

AttackMiner: A Graph Neural Network Based Approach for Attack Detection from Audit Logs

A Novel Algorithm SF for Mining Attack Scenarios Model

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Using attack graphs and intrusion evidences to extrapolate network security state

SSIRI 2009 Short Paper A New Method to Generate Attack Graphs

A graph based system for multi-stage attacks recognition

Multi-step Attack Scenarios Mining Based on Neural Network and Bayesian Network Attack Graph.

Graph Neural Network‐based Attack Prediction for Communication‐based Train Control Systems

Abnormal Event Correlation and Detection Based on Network Big Data Analysis

Building Network Attack Graph for Alert Causal Correlation

Distributed Attack Modeling Approach Based on Process Mining and Graph Segmentation.

Intrusion Scenarios Detection Based on Data Mining