APT 공격 탐지를 위한 공격 경로 및 의도 인지 시스템
Attack Path and Intention Recognition System for detecting APT Attack
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
Typical security solutions such as intrusion detection system are not suitable for detecting advanced persistent attack(APT), because they cannot draw the big picture from trivial events of security solutions. Researches on techniques for detecting multiple stage attacks by analyzing the correlations between security events or alerts are being actively conducted in academic field. However, these studies still use events from existing security system, and there is insufficient research on the structure of the entire security system suitable for advanced persistent attacks. In this paper, we propose an attack path and intention recognition system suitable for multiple stage attacks like advanced persistent attack detection. The proposed system defines the trace format and overall structure of the system that detects APT attacks based on the correlation and behavior analysis, and is designed with a structure of detection system using deep learning and big data technology, etc.
Abstract
Typical security solutions such as intrusion detection system are not suitable for detecting advanced persistent attack(APT), because they cannot draw the big picture from trivial events of security solutions. Researches on techniques for detecting multiple stage attacks by analyzing the correlations between security events or alerts are being actively conducted in academic field. However, these studies still use events from existing security system, and there is insufficient research on the structure of the entire security system suitable for advanced persistent attacks. In this paper, we propose an attack path and intention recognition system suitable for multiple stage attacks like advanced persistent attack detection. The proposed system defines the trace format and overall structure of the system that detects APT attacks based on the correlation and behavior analysis, and is designed with a structure of detection system using deep learning and big data technology, etc.
참고문헌 (19)
- 이세열, "블록체인을 적용한 사설 클라우드 기반 침입시도탐지", (사)디지털산업정보학회 논문지, 14(2), pp.11~17 (2018), (사)디지털산업정보학회[DOI]
- 김창식, "머신러닝 및 딥러닝 연구동향 분석: 토픽모델링을 중심으로", (사)디지털산업정보학회 논문지, 15(2), pp.19~28 (2019), (사)디지털산업정보학회
- J. Navarro, "A systematic survey on multi-step attack detection", Computers & Security, 76, pp.214~249 (2018)
- Z. Liu, "Correlating multi-step attack and constructing attack scenarios based on attack pattern modeling", 2008 International Conference on Information Security and Assurance, pp.214~219 (2008)
- A. Ebrahimi, "Automatic attack scenario discovering based on a new alert correlation method", 2011 IEEE International Systems Conference, pp.52~58 (2011)
- M. Bateni, "An architecture for alert correlation inspired by a comprehensive model of human immune system", International Journal of Computer Network & Information Security, pp.47~57 (2014)
- J. Wang, "A GA-based solution to an NP-hard problem of clustering security events", Proceedings of the 2006International Conference on Communications, Circuits and Systems, pp.2093~2097 (2006)
- S. Mathew, "Attack scenario recognition through heterogeneous event stream analysis", IEEE Military Communications Conference, pp.1~7 (2009)
- S. Shin, "Advanced probabilistic approach for network intrusion forecasting and detection", Expert systems with applications, 40(1), pp.315~322 (2013)
- N. K. Pandey, "ACML: capability based attack modeling language", Fourth International Conference on Information Assurance and Security, pp.147~154 (2008)
- Y. Lv, "An alert correlation algorithm based on the sequence pattern mining", IEEE Advanced Information Technology, Electronic and Automation Control Conference, pp.1146~1151 (2015)
- R. Katipally, "Multistage attack detection system for network administrators using data mining", Proceedings of the Sixth Annual Workshop on Cyber Security and Information Intelligence Research, pp.1~4 (2010)
- C. M. Chen, "Anomaly network intrusion detection using Hidden Markov Model", International Journal of Innovative Computer Information and Control, 12(2), pp.569~580 (2016)
- S. Fayyad, "New attack scenario prediction methodology", Tenth International Conference on Information Technology: New Generations, pp.53~59 (2013)
- Y. Luo, "A fictitious play based response strategy for multistage intrusion defense systems", Security and Communication Networks, 7(3), pp.473~491 (2014)
- A. Sadighian, "ONTIDS: a highly flexible context-aware and ontology based alert correlation framework", 6th International Symposium on Foundations and Practice of Security, pp.161~177 (2013)
- 임창완, "실시간 사이버 위협 지능형 분석 및 예측 기술", 정보과학회 컴퓨팅의 실제 논문지, 25(11), pp.565~570 (2019), 한국정보과학회[DOI]
- 김현진, "스마트시티의 보안을 위한 사이버보안위협정보 활용 연구", 디지털콘텐츠학회논문지, 20(6), pp.1173~1180 (2019), 한국디지털콘텐츠학회[DOI]
- J. H Eom, "Modeling of Cyber-attack Intentions Analysis Reflecting Domestic", International Situations, 2018, pp.11(1), 13~26