Abstract:Since the rapid development of the internet, the emergence of network intrusion has become the focus of studies for scholars and security enterprises. As an important device for detecting and analyzing malicious behaviors in networks, IDS (Intrusion Detection Systems) is widely deployed in enterprises, organizations and plays a very important role in cyberspace security. The massive log data produced by IDS not only contains information about intrusion behaviors but also contains potential intrusion patterns. Through normalizing, correlating, and modeling data, we can obtain the patterns of different intrusion scenarios. Based on the previous works in the area of alert correlation and analyzing, this paper proposed a framework named IACF (Intrusion Action Based Correlation Framework), which improved the process of alert aggregating, action extraction, and scenario discovery, and applied a novel method for extracting intrusion sessions based on temporal metrics. The proposed framework utilized a new grouping method for raw alerts based on the concept of intrinsic strong correlations, rather than the conventional time windows and hyper alerts. For discovering high stable correlations between actions, redundant actions and action link modes are removed from sessions by a pruning algorithm to reduce the impact of false positives, finally, a correlation graph is constructed by fusing the pruned sessions, based on the correlation graph, a prediction method for the future attack is proposed. The experiment result shows that the framework is efficient in alert correlation and intrusion scenario construction.

A Hidden Markov Model Based Framework for Tracking and Predicting of Attack Intention

Robust Algorithm for Attack Detection Based on Time‐varying Hidden Markov Model Subject to Outliers

Intrusion Alert Prediction Using a Hidden Markov Model

Hidden markov model based intrusion detection

Modeling program behaviors by hidden Markov models for intrusion detection

The prediction role of hidden Markov model in intrusion detection

A Hidden Markov Models-Based Anomaly Intrusion Detection Method

An Intrusion Action-Based IDS Alert Correlation Analysis and Prediction Framework

Online Intrusion Scenario Discovery and Prediction Based on Hierarchical Temporal Memory (HTM)

Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models

Using HMM for Intent Recognition in Cyber Security Situation Awareness

Multiple Sequential Network Attacks Detection Based on DTW-HMM

Intrusion Detection Based On Hidden Markov Model

A HMM-based Method for Anomaly Detection

A Novel Framework For Anomaly Detection Based On Hybrid Hmm-Svm Model

Anti-Attack Intrusion Detection Model Based on MPNN and Traffic Spatiotemporal Characteristics

The Research of Alert Correlation Based on Attack Intetion

Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models

Research on Intrusion Scenarios Building Based on Multiple Hypothesis Tracking

Intrusion Intention Identification Methods Based on Dynamic Bayesian Networks

MMSP: A LSTM Based Framework for Multi-Step Attack Prediction in Mixed Scenarios