SBAD: sequence based attack detection via sequence comparison

摘要: Given a stream of time-stamped events, like alerts in network monitoring setting, how can we isolate sequence that form attack? We propose Sequence Based Attack Detection (SBAD) method, which makes the following contributions: (a) it automatically identifies groups are frequent; (b) summarizes them into suspicious activity, representing with graph structures; and (c) suggests novel graph-based dissimilarity measure. As whole, SBAD is able to group alerts, visualize them, spot anomalies at level. The evaluations from three datasets--two benchmark datasets (DARPA 1999, PKDD 2007) private dataset Acer 2007 gathered Security Operation Center Taiwan--support our approach. method performs well even without help IP payload information. No need for privacy information as input easy plug existing system such an intrusion detector. To talk about efficiency, proposed deal large-scale problems, processing 300K within 20 mins on regular PC.