Visible to the public Towards probabilistic identification of zero-day attack paths

TitleTowards probabilistic identification of zero-day attack paths
Publication TypeConference Paper
Year of Publication2016
AuthorsSun, Xiaoyan, Dai, Jun, Liu, Peng, Singhal, Anoop, Yen, John
Conference Name2016 IEEE Conference on Communications and Network Security (CNS)
Date Publishedoct
KeywordsBayes methods, Bayesian Network, belief networks, Communication networks, composability, computer network security, Conferences, enterprise network security defense, feature extraction, intrusion propagation, object instance graph, Predictive Metrics, probabilistic identification, Probabilistic logic, probability, pubcrawl, Resiliency, security, sockets, ZePro, Zero Day Attacks and Defense, zero-day attack paths
AbstractZero-day attacks continue to challenge the enterprise network security defense. A zero-day attack path is formed when a multi-step attack contains one or more zero-day exploits. Detecting zero-day attack paths in time could enable early disclosure of zero-day threats. In this paper, we propose a probabilistic approach to identify zero-day attack paths and implement a prototype system named ZePro. An object instance graph is first built from system calls to capture the intrusion propagation. To further reveal the zero-day attack paths hiding in the instance graph, our system constructs an instance-graph-based Bayesian network. By leveraging intrusion evidence, the Bayesian network can quantitatively compute the probabilities of object instances being infected. The object instances with high infection probabilities reveal themselves and form the zero-day attack paths. The experiment results show that our system can effectively identify zero-day attack paths.
DOI10.1109/CNS.2016.7860471
Citation Keysun_towards_2016