基于隐马尔可夫模型的交叉多阶段网络攻击检测体系结构
Architectures for Detecting Interleaved Multi-stage Network Attacks Using Hidden Markov Models
摘要：
随着网络威胁的不断增加，开发高可靠性网络系统的需求变得越来越重要。本文的目的是解决建模和检测复杂的网络攻击，如多重交织攻击的挑战。我们提出了交错的概念，并研究如何交错多个攻击可以欺骗入侵检测系统。使用一个重要的统计机器学习（ML）技术，隐马尔可夫模型（HMM），我们开发了两个架构，考虑到隐形性质的交织攻击，可以检测和跟踪这些攻击的进展。这些架构部署了已知攻击的HMM模板数据库，并表现出不同的性能和复杂性。对于性能评估，在存在多个多阶段攻击场景的情况下，提出了各种度量，包括（1）攻击风险概率，（2）检测出错率，以及（3）正确检测的阶段的数量。广泛的仿真实验被用来证明所提出的架构的有效性。
英文摘要：
With the growing amount of cyber threats, the need for development of high-assurance cyber systems is becoming increasingly important. The objective of this paper is to address the challenges of modeling and detecting sophisticated network attacks, such as multiple interleaved attacks. We present the interleaving concept and investigate how interleaving multiple attacks can deceive intrusion detection systems. Using one of the important statistical machine learning (ML) techniques, Hidden Markov Models (HMM), we develop two architectures that take into account the stealth nature of the interleaving attacks, and that can detect and track the progress of these attacks. These architectures deploy a database of HMM templates of known attacks and exhibit varying performance and complexity. For performance evaluation, in the presence of multiple multi-stage attack scenarios, various metrics are proposed which include (1) attack risk probability, (2) detection error rate, and (3) the number of correctly detected stages. Extensive simulation experiments are used to demonstrate the efficacy of the proposed architectures.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
