| Title | Towards probabilistic identification of zero-day attack paths |
| Publication Type | Conference Paper |
| Year of Publication | 2016 |
| Authors | Sun, Xiaoyan, Dai, Jun, Liu, Peng, Singhal, Anoop, Yen, John |
| Conference Name | 2016 IEEE Conference on Communications and Network Security (CNS) |
| Date Published | oct |
| Keywords | Bayes methods, Bayesian Network, belief networks, Communication networks, composability, computer network security, Conferences, enterprise network security defense, feature extraction, intrusion propagation, object instance graph, Predictive Metrics, probabilistic identification, Probabilistic logic, probability, pubcrawl, Resiliency, security, sockets, ZePro, Zero Day Attacks and Defense, zero-day attack paths |
| Abstract | Zero-day attacks continue to challenge the enterprise network security defense. A zero-day attack path is formed when a multi-step attack contains one or more zero-day exploits. Detecting zero-day attack paths in time could enable early disclosure of zero-day threats. In this paper, we propose a probabilistic approach to identify zero-day attack paths and implement a prototype system named ZePro. An object instance graph is first built from system calls to capture the intrusion propagation. To further reveal the zero-day attack paths hiding in the instance graph, our system constructs an instance-graph-based Bayesian network. By leveraging intrusion evidence, the Bayesian network can quantitatively compute the probabilities of object instances being infected. The object instances with high infection probabilities reveal themselves and form the zero-day attack paths. The experiment results show that our system can effectively identify zero-day attack paths. |
| DOI | 10.1109/CNS.2016.7860471 |
| Citation Key | sun_towards_2016 |
Towards probabilistic identification of zero-day attack paths