Hidden Markov models for advanced persistent threats - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue International Journal of Security and Networks Année : 2019

Hidden Markov models for advanced persistent threats

Résumé

Advanced Persistent Threats (APT), attack campaigns performed by competent and resourceful actors, are a serious security risk and tools suited to their detection are needed. These attack campaigns do leave traces in the system, and it is possible to reconstruct part of the attack campaign from these traces. In this article, we describe a stochastic model for the evolution of an APT. It is based on hidden Markov models (HMM) and is accompanied by a score. The aim of this model is to validate whether the evolution of the partially reconstructed attack campaigns are indeed consistent with the evolution of an APT. In addition, the introduced score is designed to take into account the inevitable presence of undetected attacks in the attack campaigns. It also allows comparing attack campaigns of varying length, which is necessary to be able to compare attack campaigns. We validate and illustrate both the model and the score using data obtained from experts.
Fichier principal
Vignette du fichier
article.pdf (122.54 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01549196 , version 1 (28-06-2017)
hal-01549196 , version 2 (06-10-2017)

Identifiants

Citer

Guillaume Brogi, Elena Di Bernardino. Hidden Markov models for advanced persistent threats. International Journal of Security and Networks, 2019, 14 (4), pp.181. ⟨10.1504/IJSN.2019.103147⟩. ⟨hal-01549196v2⟩
442 Consultations
998 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More