Analysis of attack events based on multi-source alerts

doi:10.11772/j.issn.1001-9081.2019071229

Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (1): 123-128.DOI: 10.11772/j.issn.1001-9081.2019071229

• Cyber security • Previous Articles Next Articles

Analysis of attack events based on multi-source alerts

WANG Chunying^1,2, ZHANG Xun³, ZHAO Jinxiong³, YUAN Hui³, LI Fangjun⁴, ZHAO Bo⁴, ZHU Xiaoqin³, YANG Fan³, LYU Shichao²

1. School of Software and Microelectronics, Peking University, Beijing 102600, China;
2. Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;
3. Grid Technology Center, State Grid Gansu Electric Power Research Institute, Lanzhou Gansu 730070, China;
4. State Grid Gansu Electric Power Company, Lanzhou Gansu 730030, China

Received:2019-07-15 Revised:2019-09-04 Online:2020-01-10 Published:2019-09-29
Supported by:
This work is partially supported by the Key Project of National Natural Science Foundation of China (U1766215), the Science and Technology Project of Headquarters of State Grid Corporation of China (522722180007).

基于多源告警的攻击事件分析

王淳颖^1,2, 张驯³, 赵金雄³, 袁晖³, 李方军⁴, 赵博⁴, 朱小琴³, 杨凡³, 吕世超²

1. 北京大学软件与微电子学院, 北京 102600;
2. 中国科学院信息工程研究所物联网信息安全技术北京市重点实验室, 北京 100093;
3. 国网甘肃省电力公司电力科学研究院, 兰州 730070;
4. 国网甘肃省电力公司, 兰州 730030

通讯作者: 吕世超
作者简介:王淳颖(1997-),女,天津人,硕士研究生,主要研究方向:机器学习、数据挖掘;张驯(1982-),男,江苏扬州人,高级工程师,硕士,主要研究方向:电力信息安全管理、机器学习、无线安全、工控安全;赵金雄(1991-),男,甘肃环县人,工程师,硕士,主要研究方向:信息安全系统运检、威胁辨识、工控安全;袁晖(1989-),男,河南扶沟人,工程师,硕士,主要研究方向:信息规划、漏洞挖掘、无线通信安全;李方军(1979-),男,山东荣成人,高级工程师,硕士,主要研究方向:电力信息化建设及管理;赵博(1981-),男,甘肃平凉人,高级工程师,硕士,主要研究方向:网络与信息管理;朱小琴(1990-),女,甘肃临洮人,工程师,硕士,主要研究方向:信息安全系统运检、威胁辨识、工控安全;杨凡(1984-),男,山西运城人,工程师,硕士,主要研究方向:机器学习、数据挖掘;吕世超(1985-),男,河北保定人,助理研究员,博士,主要研究方向:无线通信安全、工控安全。
基金资助:
国家自然科学基金重点项目（U1766215）；国家电网公司总部科技项目（522722180007）。

Abstract

Abstract: In order to overcome the difficulty in discovering multi-stage attack from multi-source alerts, an algorithm was proposed to mine the attack sequence pattern. The multi-source alerts were normalized into a unified format by matching them with regular expressions. The redundant information of alerts was compressed, and the alerts of the same stage were clustered according to the association rule set trained by strong association rules, efficiently removing the redundant alerts, so that the number of alerts was reduced. Then, the clustered alerts were divided to obtain candidate attack event dataset by sliding-window, and the attack pattern mining algorithm PrefixSpan was used to find out the attack sequence patterns of multi-stage attack events. The experimental results show that the proposed algorithm can lead to an accurate and efficient analysis of alert correlation and extract the attack steps of attack events without expert knowledge. Compared with the traditional algorithm PrefixSpan, the algorithm has an increase in attack pattern mining efficiency of 48.05%.

Key words: multi-source alert, alert cluster, association rule, sequence pattern mining, multi-stage attack event

摘要： 为解决多源告警中的复杂攻击难以被发现的问题，提出一种攻击序列模式挖掘算法。利用正则表达式匹配告警，将多源告警规范化为统一格式。对冗余告警信息进行压缩，利用强关联规则训练得到的规则集聚合同一阶段的告警，有效去除冗余告警，精简告警数量。利用滑动窗口对聚合后的告警进行划分得到候选攻击事件数据集，通过改进的PrefixSpan算法挖掘得到多阶段攻击事件的攻击序列模式。实验结果表明，该算法在不依赖专家知识的前提下，能够准确并高效地分析告警相关性，还原攻击事件中的攻击步骤。相比传统PrefixSpan算法，提出的改进算法的攻击模式挖掘效率提升了48.05%。

关键词: 多源告警, 告警聚类, 关联规则, 序列模式挖掘, 多阶段攻击事件

CLC Number:

TP393

WANG Chunying, ZHANG Xun, ZHAO Jinxiong, YUAN Hui, LI Fangjun, ZHAO Bo, ZHU Xiaoqin, YANG Fan, LYU Shichao. Analysis of attack events based on multi-source alerts[J]. Journal of Computer Applications, 2020, 40(1): 123-128.

王淳颖, 张驯, 赵金雄, 袁晖, 李方军, 赵博, 朱小琴, 杨凡, 吕世超. 基于多源告警的攻击事件分析[J]. 计算机应用, 2020, 40(1): 123-128.

References

[1] FARAJI DANESHGAR F, ABBASPOUR M. Extracting fuzzy attack patterns using an online fuzzy adaptive alert correlation framework[J]. Security and Communication Networks, 2016, 9(14):2245-2260.
[2] WANG C H, CHIOU Y C. Alert correlation system with automatic extraction of attack strategies by using dynamic feature weights[J]. International Journal of Computer and Communication Engineering, 2016, 5(1):1-10.
[3] SADIGHIAN A, FERNANDEZ J M, LEMAY A, et al. ONTIDS:a highly flexible context-aware and ontology-based alert correlation framework[C]//Proceedings of the 2013 International Symposium on Foundations and Practice of Security, LNCS 8352. Cham:Springe, 2013:161-177.
[4] 任维武,胡亮,赵阔. 基于数据挖掘和本体的入侵警报关联模型[J]. 吉林大学学报(工学版), 2015, 45(3):899-906. (REN W W, HU L, ZHAO K. Intrusion alert correlation model based on data mining and ontology[J]. Journal of Jilin University (Engineering and Technology Edition), 2015, 45(3):899-906.)
[5] LIN Z, LI S, MA Y. Real-time intrusion alert correlation system based on prerequisites and consequence[C]//Proceedings of the 6th International Conference on Wireless Communications Networking and Mobile Computing. Piscataway:IEEE, 2010:1-5.
[6] WANG W, JIANG R, JIA Y, et al. KGBIAC:Knowledge Graph Based Intelligent Alert Correlation framework[C]//Proceedings of the 2017 International Symposium on Cyberspace Safety and Security, LNCS 10581. Cham:Springer, 2017:523-530.
[7] AHMADIAN RAMAKI A, RASOOLZADEGAN A. Causal knowledge analysis for detecting and modeling multi-step attacks[J]. Security and Communication Networks, 2016, 9(18):6042-6065.
[8] 张晓洪. 基于多源事件融合的网络安全态势评估方法研究[D]. 天津:天津理工大学, 2016:1-69. (ZHANG X H. The research on network security situation evaluation based on mutli-source events fusion[D]. Tianjin:Tianjin University of Technology, 2016:1-69.)
[9] 彭梦停,胡建伟,崔艳鹏. 基于数据挖掘的攻击场景提取方法研究[J].计算机应用与软件, 2018, 35(10):317-322. (PENG M T, HU J W, CUI Y P. Research of attack scenarios extraction based on data mining[J]. Computer Applications and Software, 2018, 35(10):317-322.)
[10] 李之棠,王莉,李东. 一种新的在线攻击意图识别方法研究[J]. 小型微型计算机系统, 2008, 29(7):1347-1352. (LI Z T, WANG L, LI D. Novel online attack strategy recognition technique[J]. Journal of Chinese Computer Systems, 2008, 29(7):1347-1352.)
[11] BAMASAK O, ZHANG N. A distributed reputation management scheme for mobile agent-based e-commerce applications[C]//Proceedings of the 2005 IEEE International Conference on e-technology, e-Commerce and e-Service. Piscataway:IEEE, 2005:270-275.
[12] AGRAWAL R, SRIKANT R. Mining sequential pattern[C]//Proceedings of the 11th International Conference on Data Engineering. Piscataway:IEEE, 1995:3-14.
[13] PEI J, HAN J, MORTAZAVI-ASL B, et al. PrefixSpan:mining sequential patterns efficiently by prefix-projected pattern growth[C]//Proceedings of the 17th IEEE International Conference of Data Engineering. Piscataway:IEEE, 2001:215-224.
[14] MIT Lincoln Laboratory. 2000 DARPA intrusion detection scenario specific datasets[EB/OL].[2019-05-12].http://www.ll.mit.edu/r-d/datasets/2000-darpa-intrusion-detection-scenario-specific-datasets.
[15] 王莉. 网络多步攻击识别方法研究[D]. 武汉:华中科技大学, 2007:1-132. (WANG L. Study on method of network multi-stage attack plan recognition[D]. Wuhan:Huazhong University of Science and Technology, 2007:1-132.)

Analysis of attack events based on multi-source alerts

基于多源告警的攻击事件分析

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	KANG Jun, HUANG Shan, DUAN Zongtao, LI Yixiu. Review of spatio-temporal trajectory sequence pattern mining methods [J]. Journal of Computer Applications, 2021, 41(8): 2379-2385.
[2]	YU Yongbin, QI Minhui, Nyima Tashi, WANG Lin. Association rule mining algorithm for Hopfield neural network based on threshold adaptive memristor [J]. Journal of Computer Applications, 2019, 39(3): 728-733.
[3]	CHEN Liu, FENG Shan. Two-level confidence threshold setting method for positive and negative association rules [J]. Journal of Computer Applications, 2018, 38(5): 1315-1319.
[4]	YIN Yuan, ZHANG Chang, WEN Kai, ZHENG Yunjun. Maximal frequent itemset mining algorithm based on DiffNodeset structure [J]. Journal of Computer Applications, 2018, 38(12): 3438-3443.
[5]	GU Junhua, WU Junyan, XU Xinyun, XIE Zhijian, ZHANG Suqi. Optimization and implementation of parallel FP-Growth algorithm based on Spark [J]. Journal of Computer Applications, 2018, 38(11): 3069-3074.
[6]	WANG Shuai, YANG Qiuhui, ZENG Jiayan, WAN Ying, FAN Zhening, ZHANG Guanglan. Application of weighted incremental association rule mining in communication alarm prediction [J]. Journal of Computer Applications, 2018, 38(10): 2875-2880.
[7]	TAN Zheng, LIU JingLei, YU Hang. Conditional preference mining based on MaxClique [J]. Journal of Computer Applications, 2017, 37(11): 3107-3114.
[8]	WANG Tao, QIN Xizhong, JIA Zhenhong, NIU Hongmei, CAO Chuanling. Association rules recommendation of microblog friend based on similarity and trust [J]. Journal of Computer Applications, 2016, 36(8): 2262-2267.
[9]	XU Kaiyong, GONG Xuerong, CHENG Maocai. Audit log association rule mining based on improved Apriori algorithm [J]. Journal of Computer Applications, 2016, 36(7): 1847-1851.
[10]	XU Yongxiu, LIU Xumin, XU Weixiang. Improved frequent itemset mining algorithm based on interval list [J]. Journal of Computer Applications, 2016, 36(4): 997-1001.
[11]	YANG Pengkun, PENG Hui, ZHOU Xiaofeng, SUN Yuqing. FP-MFIA: improved algorithm for mining maximum frequent itemsets based on frequent-pattern tree [J]. Journal of Computer Applications, 2015, 35(3): 775-778.
[12]	HU Shiyu, LUO Diansheng, YANG Shuang, YANG Jingwei. Load forecasting based on multi-variable LS-SVM and fuzzy recursive inference system [J]. Journal of Computer Applications, 2015, 35(2): 595-600.
[13]	FENG Yong YIN Jiena XU Hongyan. Distributed rules mining algorithm with load balance based on vertical FP-tree [J]. Journal of Computer Applications, 2014, 34(2): 396-400.
[14]	DONG Lin SHU Hong. Incremental maintenance of discovered spatial association rules [J]. Journal of Computer Applications, 2013, 33(11): 3049-3051.
[15]	ZHANG Chunsheng ZHUANG Liyan. Deductive method of association rules among compatible datasets based on Apriori [J]. Journal of Computer Applications, 2013, 33(10): 2796-2800.