An Empirical Approach to Modeling Uncertainty in Intrusion Analysis

摘要: Uncertainty is an innate feature of intrusion analysis due to the limited views provided by system monitoring tools, detection systems (IDS), and various types logs. Attackers are essentially invisible in cyber space tools can only observe symptoms or effects malicious activities. When mingled with similar from normal non-malicious activities they lead conclusions varying confidence high false positive/negative rates. This paper presents empirical approach problem uncertainty where inferred security implications low-level observations captured a simple logical language augmented certainty tags. We have designed automated reasoning process that enables us combine multiple sources data extract highly-confident attack traces numerous possible interpretations observations. developed our model empirically: starting point was true happened on campus network we studied capture essence human led about attack. then used Datalog-like encode Prolog carry out process. Our reached same as administrator question which machines were certainly compromised. automatically generated needed for handling Snort alerts natural-language descriptions rule repository, add-on analyze alerts. Keeping unchanged, applied two third-party sets one production network. results showed effective these well. believe such has potential codifying seemingly ad-hoc uncertain events, yield useful analysis.