APIN: Automatic Attack Path Identification in Computer Networks

摘要: Identifying the scope of a network attack can be difficult with limited information about nature attack. Even more is automation this process. Because this, it important to investigate new methods for mapping and quantifying threat posed by an attack, in order prioritize actions during incident response. To end we propose framework automatic path identification computer networks (APIN) leveraging observable malicious behaviors quantify score set attacks. Using two academic datasets, experimental results show that APIN able quickly reconstruct paths offer meaningful insight into multi-step threats on network, given only reasonable restrictions size structure. These insights would not possible existing tools, such as IDSs, human analysts require significant time expertise obtain same findings without APIN’s guidance.