|
|
|
篇目详细内容 |
|
【篇名】 |
Boosting performance in attack intention recognition by integrating multiple techniques |
|
【刊名】 |
Frontiers of Computer Science in China |
|
【刊名缩写】 |
Front. Comput. Sci. China |
|
【ISSN】 |
1673-7350 |
|
【EISSN】 |
1673-7466 |
|
【DOI】 |
10.1007/s11704-010-0321-y |
|
【出版社】 |
Higher Education Press and Springer-Verlag Berlin
Heidelberg |
|
【出版年】 |
2011 |
|
【卷期】 |
5
卷1期 |
|
【页码】 |
109-118
页,共
10
页 |
|
【作者】 |
Hao BAI;
Kunsheng WANG;
Changzhen HU;
Gang ZHANG;
Xiaochuan JING;
|
|
【关键词】 |
attack path; attack intention; compensatory intrusion evidence; FP-Growth |
【摘要】 |
|
Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition have been proposed. However, most of these techniques mainly focus on the alerts of an intrusion detection system and use algorithms of low efficiency that mine frequent attack patterns without reconstructing attack paths. In this paper, a novel and effective method is proposed, which integrates several techniques to identify attack intentions. Using this method, a Bayesian-based attack scenario is constructed, where frequent attack patterns are identified using an efficient data-mining algorithm based on frequent patterns. Subsequently, attack paths are rebuilt by re-correlating frequent attack patterns mined in the scenario. The experimental results demonstrate the capability of our method in rebuilding attack paths, recognizing attack intentions as well as in saving system resources. Specifically, to the best of our knowledge, the proposed method is the first to correlate complementary intrusion evidence with frequent pattern mining techniques based on the FP-Growth algorithm to rebuild attack paths and to recognize attack intentions. |
|
