Discovering Novel Attack Strategies from INFOSEC Alerts

Abstract. Correlating security alerts and discovering attack strategies are important and challenging tasks for security analysts. Recently, there have been several proposed techniques to analyze attack scenarios from security alerts. However, most of these approaches depend on a priori and hard-coded domain knowledge that lead to their limited capabilities of detecting new attack strategies. In this paper, we propose an approach to discover novel attack strategies. Our approach includes two complementary correlation mechanisms based on two hypotheses of attack step relationship. The first hypothesis is that attack steps are directly related because an earlier attack enables or positively affects the later one. For this type of attack relationship, we develop a Bayesian-based correlation engine to correlate attack steps based on security states of systems and networks. The second hypothesis is that for some related attack steps, even though they do not have obvious and direct relation...

• Type: Conference
• Year: 2004
• Where: ESORICS
• Authors: Xinzhou Qin, Wenke Lee
• Keywords: Attack Scenarios, Attack Steps, Attack Strategies, ESORICS 2004, Security Privacy