Description
Contributions from the information fusion community have enabled comprehensible traces of intrusion alerts occurring on computer networks. Traced or tracked cyber attacks are the bases for threat projection in this work. Due to its complexity, we separate threat projection into two subtasks: predicting likely next targets and predicting attacker behavior. A virtual cyber terrain is proposed for identifying likely targets. Overlaying traced alerts onto the cyber terrain reveals exposed vulnerabilities, services, and hosts. Meanwhile, a novel attempt to extract cyber attack behavior is discussed. Leveraging traditional work on prediction and compression, this work identifies behavior patterns from traced cyber attack data. The extracted behavior patterns are expected to further refine projections deduced from the cyber terrain.
Date of creation, presentation, or exhibit
7-9-2007
Document Type
Conference Paper
Department, Program, or Center
Computer Engineering (KGCOE)
Recommended Citation
D. Fava, J. Holsopple, S. J. Yang and B. Argauer, "Terrain and behavior modeling for projecting multistage cyber attacks," 2007 10th International Conference on Information Fusion, Quebec, Que., 2007, pp. 1-7. doi: 10.1109/ICIF.2007.4408131
Campus
RIT – Main Campus
Comments
© 2007 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Note: imported from RIT’s Digital Media Library running on DSpace to RIT Scholar Works in February 2014.