Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection
Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in order to detect malicious activity and policy violations. Because IDSs have a large number of false positives and false negatives and the technical nature of their alerts requires a lot of manual analysis, the...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-10-01
|
| Series: | Electronics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2079-9292/9/10/1722 |
| _version_ | 1797550554275119104 |
|---|---|
| author | Ivan Kovačević Stjepan Groš Karlo Slovenec |
| author_facet | Ivan Kovačević Stjepan Groš Karlo Slovenec |
| author_sort | Ivan Kovačević |
| collection | DOAJ |
| description | Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in order to detect malicious activity and policy violations. Because IDSs have a large number of false positives and false negatives and the technical nature of their alerts requires a lot of manual analysis, the researchers proposed approaches that automate the analysis of alerts to detect large-scale attacks and predict the attacker’s next steps. Unfortunately, many such approaches use unique datasets and success metrics, making comparison difficult. This survey provides an overview of the state of the art in detecting and projecting cyberattack scenarios, with a focus on evaluation and the corresponding metrics. Representative papers are collected while using Google Scholar and Scopus searches. Mutually comparable success metrics are calculated and several comparison tables are provided. Our results show that commonly used metrics are saturated on popular datasets and cannot assess the practical usability of the approaches. In addition, approaches with knowledge bases require constant maintenance, while data mining and ML approaches depend on the quality of available datasets, which, at the time of writing, are not representative enough to provide general knowledge regarding attack scenarios, so more emphasis needs to be placed on researching the behavior of attackers. |
| first_indexed | 2024-03-10T15:31:00Z |
| format | Article |
| id | doaj.art-dc6a23be56b049e78eafa43cb8f1c215 |
| institution | Directory Open Access Journal |
| issn | 2079-9292 |
| language | English |
| last_indexed | 2024-03-10T15:31:00Z |
| publishDate | 2020-10-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Electronics |
| spelling | doaj.art-dc6a23be56b049e78eafa43cb8f1c2152023-11-20T17:41:59ZengMDPI AGElectronics2079-92922020-10-01910172210.3390/electronics9101722Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and ProjectionIvan Kovačević0Stjepan Groš1Karlo Slovenec2University of Zagreb, Faculty of Electrical Engineering and Computing, Unska 3, HR-10000 Zagreb, CroatiaUniversity of Zagreb, Faculty of Electrical Engineering and Computing, Unska 3, HR-10000 Zagreb, CroatiaUniversity of Zagreb, Faculty of Electrical Engineering and Computing, Unska 3, HR-10000 Zagreb, CroatiaIntrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in order to detect malicious activity and policy violations. Because IDSs have a large number of false positives and false negatives and the technical nature of their alerts requires a lot of manual analysis, the researchers proposed approaches that automate the analysis of alerts to detect large-scale attacks and predict the attacker’s next steps. Unfortunately, many such approaches use unique datasets and success metrics, making comparison difficult. This survey provides an overview of the state of the art in detecting and projecting cyberattack scenarios, with a focus on evaluation and the corresponding metrics. Representative papers are collected while using Google Scholar and Scopus searches. Mutually comparable success metrics are calculated and several comparison tables are provided. Our results show that commonly used metrics are saturated on popular datasets and cannot assess the practical usability of the approaches. In addition, approaches with knowledge bases require constant maintenance, while data mining and ML approaches depend on the quality of available datasets, which, at the time of writing, are not representative enough to provide general knowledge regarding attack scenarios, so more emphasis needs to be placed on researching the behavior of attackers.https://www.mdpi.com/2079-9292/9/10/1722targeted attacksattack scenariointrusion detectionalert correlationcyber situational awarenessattack projection |
| spellingShingle | Ivan Kovačević Stjepan Groš Karlo Slovenec Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection Electronics targeted attacks attack scenario intrusion detection alert correlation cyber situational awareness attack projection |
| title | Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection |
| title_full | Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection |
| title_fullStr | Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection |
| title_full_unstemmed | Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection |
| title_short | Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection |
| title_sort | systematic review and quantitative comparison of cyberattack scenario detection and projection |
| topic | targeted attacks attack scenario intrusion detection alert correlation cyber situational awareness attack projection |
| url | https://www.mdpi.com/2079-9292/9/10/1722 |
| work_keys_str_mv | AT ivankovacevic systematicreviewandquantitativecomparisonofcyberattackscenariodetectionandprojection AT stjepangros systematicreviewandquantitativecomparisonofcyberattackscenariodetectionandprojection AT karloslovenec systematicreviewandquantitativecomparisonofcyberattackscenariodetectionandprojection |