Multiple Sequential Network Attacks Detection Based on DTW-HMM
Haitian Liu, Rong Jiang, Bin Zhou, Xing Rong, Juan Li, Aiping Li · 2022
With the increasing severity of network threats, network security has become a global concern. Especially the Sequential network attacks (SNAs), are becoming increasingly prominent. Hidden Markov Model (HMM) is often used to model such problems. By revealing the early life cycle of SNAs, it helps to understand attacker strategies. Based on this, this paper proposes a new intrusion detection mechanism for SNA detection to meet the challenges of modeling and detecting multiple sequential network attack scenarios. We developed an architecture capable of identifying these organized attack processes. The system goes through three main stages. The first stage processes the alerts output by IDS and feeds them into different sub-alert sequences belonging to different attackers. The second stage uses the DTW&1NN algorithm to classify sub-alert sequences belonging to the same SNA scenario. The third stage of the proposed system is attack decoding, which utilizes a Hidden Markov Model (HMM) to determine the most likely sequence of SNA phases for a given sequence of relevant alerts. Finally, simulation experiments are carried out based on the public dataset of CSE-CIC-IDS2018 to verify the effectiveness of the proposed architecture.