Detecting Advanced Attacks Based On Linux Logs
Lin Chen, Aidong Xu, Xiaoyun Kuang, Huahui Lv, Hang Yang, Yiwei Yang, Bo Li · 2020
Advanced attacks threaten the security of nowadays information systems. For instance, Mirai incorporates several hack tools and techniques to launch large-scale attacks without detection by traditional security tools. In this paper, we build a simulated environment to analyze the lifecycle of advanced attacks. We also design and implement an attack detection model, which could identify advanced attacks through Linux Logs. Machine learning models are employed to discriminate normal behaviors from malicious behaviors. We have conducted several comprehensive experiments, and the results demonstrate the effectiveness and efficiency of our approach when dealing with advanced attacks.