Year: 2016
Type: article
Abstract: In the era of global Internet security threats, there is an urgent need for different organizations to cooperate and jointly fight against cyber attacks. We present an algorithm that combines a privacy-preserving technique and a multi-step attack-correlation method to better balance the privacy and availability of alarm data. This algorithm is used to construct multi-step attack scenarios by discovering sequential attack-behavior patterns. It analyzes the time-sequential characteristics of attack behaviors and implements a support-evaluation method. Optimized candidate attack-sequence generation is applied to solve the problem of pre-defined association-rule complexity, as well as expert-knowledge dependency. An enhanced k -anonymity method is applied to this algorithm to preserve privacy. Experimental results indicate that the algorithm has better performance and accuracy for multi-step attack correlation than other methods, and reaches a good balance between efficiency and privacy.
DOI: 10.1007/bf03391586
Authors: Yongtang Zhang, Xianlu Luo, Haibo Luo
Institution: Neusoft Institute Guangdong
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4239234412