Abstract:Nowadays, new-generation threats often use multiple means or perform several steps to intrude into networks and ultimately reach their objective. These new threats have multi-staged, and we can understand their intrusion pattern from the kill-chain defensive model. This paper focuses on fusing heterogeneous threat intelligence collected from security information and event management systems to reconstruct multi-step attack scenarios and discover critical attack paths. However, the need for an agreed-upon vocabulary to represent the heterogeneous threat intelligence makes it difficult to model the attack scenarios accurately and efficiently. Therefore, we devise a heterogeneous threat intelligence fusing approach for real-time reconstruction of the attack scenarios. Firstly, we use structured threat information expression (STIX) to format heterogeneous threat intelligence (TI). We analyze the causal relationship of each heterogeneous threat intelligence and piece them together. Then, we model the multi-stage attack scenario reconstruction as a community discovery problem. We mine the attack scenarios with semantic correlation weight and a community detection algorithm. We finally use the open-source benchmark datasets (DARPA 2000, CICIDS 2017) and the real Internet traffic captured from the China Education Research Network backbone (CERNET) to evaluate our work. Extensive results demonstrate that our proposal can accurately reconstruct multi-step attack scenarios and discover covert C&C channels.

MODELING ATTACK SCENARIO WITH CAPABILITY

Capability-centric Attack Model for Network Security Analysis

Modeling of the Mimic Defense Based on Heterogeneous Redundancy

Attack Scenarios Reasoning, Hypothesizing and Predicting Based on Capability Transition Model

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Research of Conceptual Model Based on Attack and Defense System Design

Network Security Modeling and Cyber Attack Simulation Methodology

Analysis and Research of Attack Model

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

Modeling network attacks for scenario construction

MODELING THE INFORMATION SYSTEM FROM THE SECURITY VIEW

Multi-Step Attack-Oriented Assessment Of Network Security Situation

A Multi-Stage Attack Planning Problem Description Model Based on Knowledge Representation

Capability Modeling of Information Deceiving and Achieving in Message Tampering Confrontations.

A Stochastic Modeling of Coordinated Internal and External Attacks

Modeling Attack Process of Advanced Persistent Threat Using Network Evolution

An Effective Attack Scenario Construction Model based on Attack Steps and Stages Identification

Modeling impact of attacks, recovery, and attackability conditions for situational awareness

A Multi-Stage Attack Scenario Recognition Algorithm Based on Intelligent Planning

A Two-Dimension Security Assessing Model for CMDs Combined with Generalized Stochastic Petri Net

Attack Scenario Reconstruction Via Fusing Heterogeneous Threat Intelligence