RTMA: Real Time Mining Algorithm for Multi-Step Attack Scenarios Reconstruction
Yu Zhang, Shiman Zhao, Jianzhong Zhang · 2019
Today, most attackers attack the network in a penetrating manner. Attackers first break into some hosts, and then use these hosts as a springboard for attack purposes (multi-step attack strategy). In order to detect malicious attacks, Intrusion Detection Systems (IDSs) installed in the network monitor network traffic. Besides, alerts generated by IDSs can help reconstruct multi-step attack scenarios. Multi-step attack scenarios can reliably reflect the infiltration process of the attacker to the target network. However, the integrity and real-time of multi-step attack scenarios reconstruction cannot meet our requirements. Therefore, we propose an efficient framework. The framework uses the concept of Markov chain and combines statistical and mining techniques to correlate alerts. Finally, we reconstruct multi-step attack scenarios by combining attack patterns between different hosts. More im-portantly, the framework can effectively reduce false-positives. A reduction ratio of 96% is achieved on the DARPA 2000 dataset. Therefore, we can provide effective guarantee for the accuracy, integrity and real-time of multi-step attack scenarios reconstruction.