Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats
Cyber security has become a matter of a global interest, and several attacks target industrial companies and governmental organizations. The advanced persistent threats (APTs) have emerged as a new and complex version of multi-stage attacks (MSAs), targeting selected companies and organizations. Cur...
| Main Authors: | , , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2019-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8767917/ |
| _version_ | 1819290475845124096 |
|---|---|
| author | Ibrahim Ghafir Konstantinos G. Kyriakopoulos Sangarapillai Lambotharan Francisco J. Aparicio-Navarro Basil Assadhan Hamad Binsalleeh Diab M. Diab |
| author_facet | Ibrahim Ghafir Konstantinos G. Kyriakopoulos Sangarapillai Lambotharan Francisco J. Aparicio-Navarro Basil Assadhan Hamad Binsalleeh Diab M. Diab |
| author_sort | Ibrahim Ghafir |
| collection | DOAJ |
| description | Cyber security has become a matter of a global interest, and several attacks target industrial companies and governmental organizations. The advanced persistent threats (APTs) have emerged as a new and complex version of multi-stage attacks (MSAs), targeting selected companies and organizations. Current APT detection systems focus on raising the detection alerts rather than predicting APTs. Forecasting the APT stages not only reveals the APT life cycle in its early stages but also helps to understand the attacker's strategies and aims. This paper proposes a novel intrusion detection system for APT detection and prediction. This system undergoes two main phases; the first one achieves the attack scenario reconstruction. This phase has a correlation framework to link the elementary alerts that belong to the same APT campaign. The correlation is based on matching the attributes of the elementary alerts that are generated over a configurable time window. The second phase of the proposed system is the attack decoding. This phase utilizes the hidden Markov model (HMM) to determine the most likely sequence of APT stages for a given sequence of correlated alerts. Moreover, a prediction algorithm is developed to predict the next step of the APT campaign after computing the probability of each APT stage to be the next step of the attacker. The proposed approach estimates the sequence of APT stages with a prediction accuracy of at least 91.80%. In addition, it predicts the next step of the APT campaign with an accuracy of 66.50%, 92.70%, and 100% based on two, three, and four correlated alerts, respectively. |
| first_indexed | 2024-12-24T03:23:20Z |
| format | Article |
| id | doaj.art-0d32df2849f14f7eb4071f7aae4946b3 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-24T03:23:20Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-0d32df2849f14f7eb4071f7aae4946b32022-12-21T17:17:24ZengIEEEIEEE Access2169-35362019-01-017995089952010.1109/ACCESS.2019.29302008767917Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent ThreatsIbrahim Ghafir0https://orcid.org/0000-0003-3702-3866Konstantinos G. Kyriakopoulos1https://orcid.org/0000-0002-7498-4589Sangarapillai Lambotharan2https://orcid.org/0000-0001-5255-7036Francisco J. Aparicio-Navarro3https://orcid.org/0000-0002-1511-7805Basil Assadhan4Hamad Binsalleeh5Diab M. Diab6Wolfson School of Mechanical, Electrical and Manufacturing Engineering, Loughborough University, Loughborough, U.K.Wolfson School of Mechanical, Electrical and Manufacturing Engineering, Loughborough University, Loughborough, U.K.Wolfson School of Mechanical, Electrical and Manufacturing Engineering, Loughborough University, Loughborough, U.K.Faculty of Computing, Engineering and Media, De Montfort University, Leicester, U.K.Department of Electrical Engineering, King Saud University, Riyadh, Saudi ArabiaDepartment of Computer Science, Imam Muhammad Ibn Saud Islamic University, Riyadh, Saudi ArabiaDepartment of Computer Science, King Saud University, Riyadh, Saudi ArabiaCyber security has become a matter of a global interest, and several attacks target industrial companies and governmental organizations. The advanced persistent threats (APTs) have emerged as a new and complex version of multi-stage attacks (MSAs), targeting selected companies and organizations. Current APT detection systems focus on raising the detection alerts rather than predicting APTs. Forecasting the APT stages not only reveals the APT life cycle in its early stages but also helps to understand the attacker's strategies and aims. This paper proposes a novel intrusion detection system for APT detection and prediction. This system undergoes two main phases; the first one achieves the attack scenario reconstruction. This phase has a correlation framework to link the elementary alerts that belong to the same APT campaign. The correlation is based on matching the attributes of the elementary alerts that are generated over a configurable time window. The second phase of the proposed system is the attack decoding. This phase utilizes the hidden Markov model (HMM) to determine the most likely sequence of APT stages for a given sequence of correlated alerts. Moreover, a prediction algorithm is developed to predict the next step of the APT campaign after computing the probability of each APT stage to be the next step of the attacker. The proposed approach estimates the sequence of APT stages with a prediction accuracy of at least 91.80%. In addition, it predicts the next step of the APT campaign with an accuracy of 66.50%, 92.70%, and 100% based on two, three, and four correlated alerts, respectively.https://ieeexplore.ieee.org/document/8767917/Advanced persistent threatintrusion detection systemalert correlationhidden Markov modelattack prediction |
| spellingShingle | Ibrahim Ghafir Konstantinos G. Kyriakopoulos Sangarapillai Lambotharan Francisco J. Aparicio-Navarro Basil Assadhan Hamad Binsalleeh Diab M. Diab Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats IEEE Access Advanced persistent threat intrusion detection system alert correlation hidden Markov model attack prediction |
| title | Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats |
| title_full | Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats |
| title_fullStr | Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats |
| title_full_unstemmed | Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats |
| title_short | Hidden Markov Models and Alert Correlations for the Prediction of Advanced Persistent Threats |
| title_sort | hidden markov models and alert correlations for the prediction of advanced persistent threats |
| topic | Advanced persistent threat intrusion detection system alert correlation hidden Markov model attack prediction |
| url | https://ieeexplore.ieee.org/document/8767917/ |
| work_keys_str_mv | AT ibrahimghafir hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT konstantinosgkyriakopoulos hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT sangarapillailambotharan hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT franciscojaparicionavarro hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT basilassadhan hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT hamadbinsalleeh hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats AT diabmdiab hiddenmarkovmodelsandalertcorrelationsforthepredictionofadvancedpersistentthreats |