Improving the Quality of Alerts and Predicting Intruder's Next Goal with Hidden Colored Petri-Net
Intrusion detection systems (IDS) often provide poor quality alerts, which are insufficient to support rapid identification of ongoing attacks or predict an intruder’s next likely goal. In this paper, we propose a novel approach to alert post-processing and correlation, the Hidden Colored Petri-Net (HCPN). Different from most other alert correlation methods, our approach treats the alert correlation problem as an inference problem rather than a filter problem. Our approach assumes that the intruder’s actions are unknown to the IDS and can be inferred only from the alerts generated by the IDS sensors. HCPN can describe the relationship between different steps carried out by intruders, model observations (alerts) and transitions (actions) separately, and associate each token element (system state) with a probability (or confidence). The model is an extension to Colored Petri-Net (CPN) .It is so called “hidden” because the transitions (actions) are not directly observable but can be inferred by looking through the observations (alerts). These features make HCPN especially suitable for discovering intruders’ actions from their partial observations (alerts,) and predicting intruders’ next goal. Our experiments on DARPA evaluation datasets and the attack scenarios from the Grand Challenge Problem (GCP) show that HCPN has promise as a way to reducing false positives and negatives, predicting intruder’s next possible action, uncovering intruders’ intrusion strategies after the attack scenario has happened, and providing confidence scores.
- Research Organization:
- Pacific Northwest National Lab. (PNNL), Richland, WA (United States)
- Sponsoring Organization:
- USDOE
- DOE Contract Number:
- AC05-76RL01830
- OSTI ID:
- 984681
- Report Number(s):
- PNNL-SA-49427; CNETDP; TRN: US201016%%1348
- Journal Information:
- Computer Networks, 51(3):632-654, Vol. 51, Issue 3; ISSN 0376-5075
- Country of Publication:
- United States
- Language:
- English
Similar Records
SHARP-Net: Platform for Self-Healing and Attack Resilient PMU Networks
Sensing intruders using entanglement: a photonic quantum fence
Related Subjects
99 GENERAL AND MISCELLANEOUS//MATHEMATICS, COMPUTING, AND INFORMATION SCIENCE
INTRUSION DETECTION SYSTEMS
ALARM SYSTEMS
QUALITY ASSURANCE
H CODES
FORECASTING
SABOTAGE
COMPUTERIZED SIMULATION
Intrusion Detection
Alert Correlation
Hidden Colored Petri-Net