[show abstract]
[hide abstract]
ABSTRACT: Recognizing attack intention is crucial for security analysis. In recent years, a number of methods for attack intention recognition
have been proposed. However, most of these techniques mainly focus on the alerts of an intrusion detection system and use
algorithms of low efficiency that mine frequent attack patterns without reconstructing attack paths. In this paper, a novel
and effective method is proposed, which integrates several techniques to identify attack intentions. Using this method, a
Bayesian-based attack scenario is constructed, where frequent attack patterns are identified using an efficient data-mining
algorithm based on frequent patterns. Subsequently, attack paths are rebuilt by recorrelating frequent attack patterns mined
in the scenario. The experimental results demonstrate the capability of our method in rebuilding attack paths, recognizing
attack intentions as well as in saving system resources. Specifically, to the best of our knowledge, the proposed method is
the first to correlate complementary intrusion evidence with frequent pattern mining techniques based on the FP-Growth algorithm
to rebuild attack paths and to recognize attack intentions.
Keywordsattack path–attack intention–compensatory intrusion evidence–FP-Growth
Frontiers of Computer Science in China 04/2012; 5(1):109-118. · 0.27 Impact Factor
