• Login
    View Item 
    •   DORA Home
    • Faculty of Computing, Engineering and Media
    • School of Computer Science and Informatics
    • View Item
    •   DORA Home
    • Faculty of Computing, Engineering and Media
    • School of Computer Science and Informatics
    • View Item
    JavaScript is disabled for your browser. Some features of this site may not work without it.

    Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats

    Thumbnail
    View/Open
    Camera Ready (587.8Kb)
    Date
    2019-07-22
    Author
    Ghafir, Ibrahim;
    Kyriakopoulos, Konstantinos G;
    Lambotharan, Sangarapillai;
    Aparicio-Navarro, Francisco J;
    AsSadhan, Basil;
    BinSalleeh, Hamad;
    Diab, Diab M.
    Metadata
    Show attachments and full item record
    Abstract
    Cyber security has become a matter of a global interest and several attacks target industrial companies and governmental organisations. The Advanced Persistent Threats (APTs) have emerged as a new and complex version of Multi-Stage Attacks (MSAs), targeting selected companies and organisations. Current APT detection systems focus on raising the detection alerts rather than predicting APTs. Forecasting the APT stages not only reveals the APT life cycle in its early stages but also helps to understand the attacker’s strategies and aims. This work proposes a novel intrusion detection system for APT detection and prediction. This system undergoes two main phases, the first one achieves the attack scenario reconstruction. This phase has a correlation framework to link the elementary alerts that belong to the same APT campaign. The correlation is based on matching the attributes of the elementary alerts which are generated over a configurable time window. The second phase of the proposed system is the attack decoding. This phase utilises the Hidden Markov Model (HMM) to determine the most likely sequence of APT stages for a given sequence of correlated alerts. Moreover, a prediction algorithm is developed to predict the next step of the APT campaign after computing the probability of each APT stage to be the next step of the attacker. The proposed approach estimates the sequence of APT stages with a prediction accuracy of at least 91:80%. Additionally, it predicts the next step of the APT campaign with an accuracy of 66:50%, 92:70% and 100% based on two, three and four correlated alerts, respectively.
    Description
    Citation : Ghafir, I. et al., (2019). Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats. IEEE Access, pp.1–1.
    URI
    https://www.dora.dmu.ac.uk/handle/2086/18257
    DOI
    https://doi.org/10.1109/access.2019.2930200
    ISSN : 2169-3536
    Peer Reviewed : Yes
    Collections
    • School of Computer Science and Informatics [2966]

    Submission Guide | Reporting Guide | Reporting Tool | DMU Open Access Libguide | Take Down Policy | Connect with DORA
    DMU LIbrary
     

     

    Browse

    All of DORACommunities & CollectionsAuthorsTitlesSubjects/KeywordsResearch InstituteBy Publication DateBy Submission DateThis CollectionAuthorsTitlesSubjects/KeywordsResearch InstituteBy Publication DateBy Submission Date

    My Account

    Login

    Submission Guide | Reporting Guide | Reporting Tool | DMU Open Access Libguide | Take Down Policy | Connect with DORA
    DMU LIbrary