Detection of complex cyber attacks

Ian Gregorio- de Souza; Vincent H. Berk; Annarita Giani; George Bakos; Marion Bates; George Cybenko; Doug Madory

doi:10.1117/12.670131

10 May 2006 Detection of complex cyber attacks

Ian Gregorio- de Souza, Vincent H. Berk, Annarita Giani, George Bakos, Marion Bates, George Cybenko, Doug Madory

Proceedings Volume 6201, Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense V; 620106 (2006) https://doi.org/10.1117/12.670131
Event: Defense and Security Symposium, 2006, Orlando (Kissimmee), Florida, United States

Abstract

One significant drawback to currently available security products is their inabilty to correlate diverse sensor input. For instance, by only using network intrusion detection data, a root kit installed through a weak username-password combination may go unnoticed. Similarly, an administrator may never make the link between deteriorating response times from the database server and an attacker exfiltrating trusted data, if these facts aren't presented together. Current Security Information Management Systems (SIMS) can collect and represent diverse data but lack sufficient correlation algorithms. By using a Process Query System, we were able to quickly bring together data flowing from many sources, including NIDS, HIDS, server logs, CPU load and memory usage, etc. We constructed PQS models that describe dynamic behavior of complicated attacks and failures, allowing us to detect and differentiate simultaneous sophisticated attacks on a target network. In this paper, we discuss the benefits of implementing such a multistage cyber attack detection system using PQS. We focus on how data from multiple sources can be combined and used to detect and track comprehensive network security events that go unnoticed using conventional tools.

Citation Download Citation

Ian Gregorio- de Souza, Vincent H. Berk, Annarita Giani, George Bakos, Marion Bates, George Cybenko, and Doug Madory "Detection of complex cyber attacks", Proc. SPIE 6201, Sensors, and Command, Control, Communications, and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense V, 620106 (10 May 2006); https://doi.org/10.1117/12.670131

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available