Attack Map Generation Using Stacked Autoencoders
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-attack detection systems face challenges such as false positives, failure to detect new and evasive attacks, and the difficulty in connecting isolated alerts to form a comprehensive picture, due to incomplete, inaccurate, or varying attack patterns, and missing data, leading to potential attacks being overlooked.
Innovation Solution
A computer-implemented method using stacked autoencoders to extract features from network packet logs, generating a directed graph of attack events, and clustering these features to create an attack map that integrates multiple attack patterns, enabling the detection of potential cyber-attacks and predicting their likelihood by correlating event logs and network configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection tools are used to monitor cyber-attacks, then detection capability is provided, but false positives occur and new/evasive attacks are not detected
Solution Approach 1:
The system performs preliminary actions by collecting comprehensive log data from multiple sources (network packets, system logs, application logs) before detection occurs. This pre-collection and organization of data in a standardized format enables more accurate analysis during actual attack detection, reducing both false positives and missed detections.
Solution Approach 2:
The system merges multiple data sources and detection methods into a unified analysis framework. By combining logs from network, system, and application layers, and integrating multiple detection techniques, the system achieves more reliable and precise attack detection than individual tools could provide alone.
2Loss of information
If alerts from multiple detection tools are collected, then comprehensive security monitoring is achieved, but the complexity of joining individual occurrences increases
Solution Approach 1:
The system segments the complex data integration task into manageable components by standardizing logs from different sources into a common format. Each log source is processed and normalized independently, then combined through structured relationships, reducing the overall complexity while maintaining information completeness.
Solution Approach 2:
The system introduces an intermediary standardized log format and normalization layer between diverse data sources and the analysis engine. This intermediary structure acts as a mediator that translates various log formats into a unified representation, simplifying the integration process while preserving all relevant information.
3Loss of information
If detailed log data is collected from multiple sources, then comprehensive attack information is obtained, but the volume of data to be processed increases
Solution Approach 1:
The system extracts only the relevant and essential features from the comprehensive log data through standardized formatting and normalization. By taking out and retaining only the critical information needed for attack detection while discarding redundant data, the system maintains information completeness while reducing processing volume.
Solution Approach 2:
The system changes the parameters of raw log data by transforming them into standardized formats with consistent structures and schemas. This parameter transformation organizes the data efficiently, making it more compact and easier to process while preserving all necessary attack-related information.
4Reliability
If attack patterns are predefined for detection, then known attacks can be detected, but new and evasive attacks are missed
Solution Approach 1:
The system implements dynamic detection capabilities that can adapt to new attack patterns. By using standardized log structures that capture comprehensive attack indicators and employing flexible analysis methods, the system can evolve its detection patterns to identify new and evasive attacks while maintaining effectiveness against known threats.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A computer implemented method of computer security for a host computer system in communication with remote computer systems, the method comprising: generating an attack map as a directed graph data structure modelling individual events leading to an exploitation of the host computer system, the attack map being generated in a training phase of the host computer system in which the host is subjected to attacks by one or more attacking remote computer systems, and generating the attack map includes the steps of: a) collecting a log of each of a plurality of attack events occurring at the host including network packets involved in each attack event; b) using stacked autoencoders to extract features from the log event in each attack; c) generating a directed graph representation based on each of the extracted features based on a temporal relationship between events for each extracted feature and a predefined definition of each of a plurality of attack patterns defining events and temporal relationships between events, using the attack map in an operational phase of the host computer system to detect security events occurring in a sequence constituting a path through the attack map to identify a sequence of events indicative of an attack, and responsive to the identification, deploying one or more security facilities to mitigate the attack.