TY - GEN
T1 - Combining Dynamic and Static Attack Information for Attack Tracing and Event Correlation
AU - Alshamrani, Adel
AU - Chowdhary, Ankur
AU - Mjihil, Oussama
AU - Myneni, Sowmya
AU - Huang, Dijiang
N1 - Funding Information:
This research is based upon work supported by the NRL N00173-15-G017, NSF Grants 1642031, 1528099, and 1723440, and NSFC Grants 61628201 and 61571375.
Publisher Copyright:
© 2018 IEEE.
PY - 2018
Y1 - 2018
N2 - Many sophisticated attacks, e.g. Advanced Persistent Threats (APTs), have emerged with a variety of different attack forms. APT employs a wide range of sophisticated reconnaissance and information-gathering tools, as well as attack tools and methods. The diversity and stealthiness of APT make it a challenging threat to current networking systems. The attackers are very skilled and try to hide in a system undetected for a long period of time with the incentive to steal and collect invaluable Current commonly used solutions (firewalls, Intrusion Detection Systems, proxies, etc.) show the limited efficiency of detecting APT. Thus, in this paper, we design a solution that is based on multi-source data combination to learn the adversarial behavior of suspicious users as well as to optimally select a proper countermeasure.
AB - Many sophisticated attacks, e.g. Advanced Persistent Threats (APTs), have emerged with a variety of different attack forms. APT employs a wide range of sophisticated reconnaissance and information-gathering tools, as well as attack tools and methods. The diversity and stealthiness of APT make it a challenging threat to current networking systems. The attackers are very skilled and try to hide in a system undetected for a long period of time with the incentive to steal and collect invaluable Current commonly used solutions (firewalls, Intrusion Detection Systems, proxies, etc.) show the limited efficiency of detecting APT. Thus, in this paper, we design a solution that is based on multi-source data combination to learn the adversarial behavior of suspicious users as well as to optimally select a proper countermeasure.
KW - Advanced Persistent Threats
KW - Attack Graph
KW - Intrusion Detection Systems
UR - http://www.scopus.com/inward/record.url?scp=85063452879&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85063452879&partnerID=8YFLogxK
U2 - 10.1109/GLOCOM.2018.8647326
DO - 10.1109/GLOCOM.2018.8647326
M3 - Conference contribution
AN - SCOPUS:85063452879
T3 - 2018 IEEE Global Communications Conference, GLOBECOM 2018 - Proceedings
BT - 2018 IEEE Global Communications Conference, GLOBECOM 2018 - Proceedings
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2018 IEEE Global Communications Conference, GLOBECOM 2018
Y2 - 9 December 2018 through 13 December 2018
ER -