Abstract
This chapter studies the zero-day attack path identification problem. Detecting zero-day attacks is a fundamental challenge faced by enterprise network security defense. A multi-step attack involving one or more zero-day exploits forms a zero-day attack path. This chapter describes a prototype system called ZePro, which takes a probabilistic approach for zero-day attack path identification. ZePro first constructs a network-wide system object instance graph by parsing system calls collected from all hosts in the network, and then builds a Bayesian network on top of the instance graph. The instance-graph-based Bayesian network is able to incorporate the collected intrusion evidence and infer the probabilities of object instances being infected. By connecting the instances with high probabilities, ZePro is able to generate the zero-day attack paths. This chapter evaluated the effectiveness of ZePro for zero-day attack path identification.
| Original language | English (US) |
|---|---|
| Title of host publication | Network Security Metrics |
| Publisher | Springer International Publishing |
| Pages | 95-115 |
| Number of pages | 21 |
| ISBN (Electronic) | 9783319665054 |
| ISBN (Print) | 9783319665047 |
| DOIs | |
| State | Published - Nov 15 2017 |
Fingerprint
All Science Journal Classification (ASJC) codes
- Computer Science(all)
Cite this
}
Using Bayesian networks to fuse intrusion evidences and detect zero-day attack paths. / Sun, Xiaoyan; Dai, Jun; Liu, Peng; Singhal, Anoop; Yen, John.
Network Security Metrics. Springer International Publishing, 2017. p. 95-115.Research output: Chapter in Book/Report/Conference proceeding › Chapter
TY - CHAP
T1 - Using Bayesian networks to fuse intrusion evidences and detect zero-day attack paths
AU - Sun, Xiaoyan
AU - Dai, Jun
AU - Liu, Peng
AU - Singhal, Anoop
AU - Yen, John
PY - 2017/11/15
Y1 - 2017/11/15
N2 - This chapter studies the zero-day attack path identification problem. Detecting zero-day attacks is a fundamental challenge faced by enterprise network security defense. A multi-step attack involving one or more zero-day exploits forms a zero-day attack path. This chapter describes a prototype system called ZePro, which takes a probabilistic approach for zero-day attack path identification. ZePro first constructs a network-wide system object instance graph by parsing system calls collected from all hosts in the network, and then builds a Bayesian network on top of the instance graph. The instance-graph-based Bayesian network is able to incorporate the collected intrusion evidence and infer the probabilities of object instances being infected. By connecting the instances with high probabilities, ZePro is able to generate the zero-day attack paths. This chapter evaluated the effectiveness of ZePro for zero-day attack path identification.
AB - This chapter studies the zero-day attack path identification problem. Detecting zero-day attacks is a fundamental challenge faced by enterprise network security defense. A multi-step attack involving one or more zero-day exploits forms a zero-day attack path. This chapter describes a prototype system called ZePro, which takes a probabilistic approach for zero-day attack path identification. ZePro first constructs a network-wide system object instance graph by parsing system calls collected from all hosts in the network, and then builds a Bayesian network on top of the instance graph. The instance-graph-based Bayesian network is able to incorporate the collected intrusion evidence and infer the probabilities of object instances being infected. By connecting the instances with high probabilities, ZePro is able to generate the zero-day attack paths. This chapter evaluated the effectiveness of ZePro for zero-day attack path identification.
UR - http://www.scopus.com/inward/record.url?scp=85042706016&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85042706016&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-66505-4_5
DO - 10.1007/978-3-319-66505-4_5
M3 - Chapter
AN - SCOPUS:85042706016
SN - 9783319665047
SP - 95
EP - 115
BT - Network Security Metrics
PB - Springer International Publishing
ER -