Information security

•Download as PPTX, PDF•

0 likes•117 views

Network Security Risk Assessment System Based on Attack Graph and Markov Chain. Automatically and periodically collect network topology and vulnerability data Combining the improved CVSS and probability evaluation of attack path

Technology

Paper Presentation
“Network Security Risk Assessment System
Based on Attack Graph and Markov Chain”
written by
Fuxiong Sun, Juntao Pi, Jin Lv and Tian Cao
presented by
Kishor Datta Gupta
COMP-8327
Friday 14 Feb 2018

Introduction
Propose new model for Network Security Risk Assessment
Model (NSRAM)
Based on
• Penetration test
• Attack graph
• CVSS
By Using
Markov chain : For Calculate the risk value
End result:
Detect the risk level with magnitude of probability

Background
• Markov chain :
A stochastic model describing a sequence of possible events in which the probability of
each event depends only on the state attained in the previous event.
• Attack Graphs:
Attack graphs depict ways in which an adversary exploits system vulnerabilities to achieve
a desired state.
• CVSS
Common Vulnerability Scoring System

Related works
NSRAM model based on
• Bayesian network and event tree by Jinsoo shin
• Fuzzy, AHP and D-S evidence theories by Fang yang
• Risk theory by Advanced material research
• Immunity algorithm by Yuah Ha
• Polynomial complexity with network flow Attack
• Attack Graph based on graph kernel by Yu yanjun
• Markov time varying model by Wang Xiao

Modules
• Information acquisition
• Penetration test
• Automatic Generation of attack graph
• Attack graph evaluation

Information Acquisition
• Network Environment
• Test steps
• Target information – five tuple pattern
 Host_id : host identifier
 Host_vulSet : Vulnerabilities in host with CVE score
 Host_con: Network of Host
 Host_port: Open ports in host
 Host_data: Host weight based on location & importance

Penetration Implementation
• Ruby script call security tools
• Tools scan and penetrate network
• Use host_vulset to generate report
Used tools: burp suite, nikto, metasploit

Automatic Generation of Attack Graph
Breadth-First traversal use to generate graph
• Att _id represents an attacker.
• Att_start is the Host_id which starts to attack.
• Att_target is the Host_id of target host.
• Att_getAuth is access rights obtained after a successful attack.
• Att_other refers to the attack path, attack time, attack ability
and other information.

Attack Graph Evaluation
• CVSS standard is used to score vulnerabilities on an
atomic node.
• According to Host_con, all attack paths are drawn
• NSRAM takes the largest probability of attack path as
the whole risk probability of the system

System Modeling(Attack Graph)
Attack graph is defined as 𝐴 = (𝐴𝑠 ∪ 𝐴𝑑 , 𝑇, 𝑅, 𝐸).
As=Starting node
Ad=destination node
T=an attack of node
R=Relation between state
E= Directed edges

Markov Chain Risk Assessment
MC=(I, P, A)
where
• I= {𝑏1, 𝑏2, … 𝑏𝑚} is the state space
• P =transition probability matrix.
• A={𝐺1, 𝐺2, 𝐺3, . . . , 𝐺𝑘 }. The A is called the set of all available
attack actions.

Attack Graph with Transition Probability

Conclusion
• Automatically and periodically collect network
topology and vulnerability data
• Combining the improved CVSS and probability
evaluation of attack path
Future work:
Incremental evaluation of attack graph and path will
greatly improve the efficiency of the model
The End – Thank You!

Network scanning is the process of gathering detailed information about targets on a network through complex reconnaissance techniques. It identifies active machines, operating systems, open ports and services. This enables attackers to profile organizations by discovering specific IP addresses, OSs, system architectures and services running on each computer. Common types of scanning include port scanning to identify open ports and services, network scanning to find active hosts and IP addresses, and vulnerability scanning to detect known weaknesses. The objectives of network scanning are to discover live hosts and open ports, identify OSs and applications to determine the best means of entry and exploit vulnerabilities. Nmap is a widely used security scanner that sends crafted packets to analyze responses and map networks by identifying hosts, ports, services, firewalls

M43057580

IJERA Editor

International Journal of Engineering Research and Applications (IJERA) is an open access online peer reviewed international journal that publishes research and review articles in the fields of Computer Science, Neural Networks, Electrical Engineering, Software Engineering, Information Technology, Mechanical Engineering, Chemical Engineering, Plastic Engineering, Food Technology, Textile Engineering, Nano Technology & science, Power Electronics, Electronics & Communication Engineering, Computational mathematics, Image processing, Civil Engineering, Structural Engineering, Environmental Engineering, VLSI Testing & Low Power VLSI Design etc.

Replay of Malicious Traffic in Network Testbeds

DETER-Project

In this paper we present tools and methods to integrate attack measurements from the Internet with controlled experimentation on a network testbed. We show that this approach provides greater fidelity than synthetic models. We compare the statistical properties of real-world attacks with synthetically generated constant bit rate attacks on the testbed. Our results indicate that trace replay provides fine time-scale details that may be absent in constant bit rate attacks. Additionally, we demonstrate the effectiveness of our approach to study new and emerging attacks. We replay an Internet attack captured by the LANDER system on the DETERLab testbed within two hours. Data and tools from the paper are available at: http://montage.deterlab.net/magi/hst2013tools Also read the LANDER Blog entry at: http://ant.isi.edu/blog/?p=411

USE OF MARKOV CHAIN FOR EARLY DETECTING DDOS ATTACKS

IJNSA Journal

DDoS has a variety of types of mixed attacks. Botnet attackers can chain different types of DDoS attacks to confuse cybersecurity defenders. In this article, the attack type can be represented as the state of the model. Considering the attack type, we use this model to calculate the final attack probability. The final attack probability is then converted into one prediction vector, and the incoming attacks can be detected early before IDS issues an alert. The experiment results have shown that the prediction model that can make multi-vector DDoS detection and analysis easier.

Cyber Attacks Spatial Analysis

Shwetha Narayanan

This document summarizes a project analyzing cyber attack hotspots in real time from streaming data. It discusses using anti-virus company data at 4000-6000 events per minute, scaling up using augmented data, and calculating Getis-Ord scores to identify statistically significant clusters of attacks. It also covers implementing a data pipeline using Kafka streams, handling different data formats with custom serializers, and addressing errors like inability to create internal topics. Screenshots show examples of visualizing hotspots and trends.

2.10 Security of RSA.pptx

girilogu2

The document discusses security issues related to the RSA cryptosystem. It outlines four approaches to attacking RSA: brute force, mathematical attacks, timing attacks, and chosen ciphertext attacks. It then focuses on mathematical attacks, explaining that the primary mathematical attack is factoring the product of the two primes used to generate the public and private keys. It also discusses timing attacks and defenses against them, as well as chosen ciphertext attacks and defenses through padding.

Applying Provenance in APT Monitoring and Analysis Practical Challenges for S...

Graeme Jenkinson

Advanced Persistent Threats (APT) are a class of security threats in which a well-resourced attacker targets a specific individual or organisation with a predefined goal. This typically involves exfiltration of confidential material, although increasingly attacks target the encryption or destruction of mission critical data. With traditional prevention and detection mechanisms failing to stem the tide of such attacks, there is a pressing need for new monitoring and analysis tools that reduce both false-positive rates and the cognitive burden on human analysts. We propose that local and distributed provenance meta-data can simplify and improve monitoring and analysis of APTs by providing a single, authoritative sequence of events that captures the context (and side effects) of potentially malicious activities. Provenance metadata allows a human analyst to backtrack from detection of malicious activity to the point of intrusion and, similarly, to work forward to fully understand the consequences. Applying provenance to APT monitoring and analysis introduces some significantly different challenges and requirements in comparison to more traditional applications. Drawing from our experiences working with and adapting the OPUS (Observed Provenance in User Space) system to an APT monitoring and analysis use case, we introduce and discuss some of the key challenges in this space. These preliminary observations are intended [Copyright notice will appear here once 'preprint' option is removed.] to prime a discussion within the community about the design space for scalable, efficient and trustworthy distributed provenance for scenarios that impose different constraints from traditional provenance applications such as workflow and data processing frameworks.

Intrusion detection using data mining

balbeerrawat

This document describes a project to develop an intrusion detection system using data mining techniques. It discusses approaches to intrusion detection including signature-based and anomaly-based methods. For the project, a hybrid network-based and host-based intrusion detection system is proposed. Data preprocessing and mining techniques including clustering, outlier detection, and classification are applied to network packet data and system call logs to detect attacks.

A Network Intrusion Detection System (NIDS) monitors a network for malicious activities or policy violations [1]. The Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on x86 hardware virtualization extensions [2]. We design and implement a back-propagation network intrusion detection system in KVM. Compared to traditional Back Propagation (BP) NIDS, the Particle Swarm Optimization (PSO) algorithm is applied to improve efficiency. The results show an improved system in terms of recall and precision along with missing detection rates.

Security Mechanisms for Organic Mesh Networks - CAST Security Award 2007

Kalman Graffi

The document proposes security frameworks for organic mesh networks. It discusses challenges around node authentication, secure routing, and misbehavior detection in networks without a trusted third party. The contribution includes a bootstrapping mechanism for node authentication, the AntSec secure routing protocol, the WatchAnt one-hop misbehavior detector, and a reputation management system. Simulation results show AntSec improves throughput over traditional protocols and WatchAnt quickly and robustly detects misbehavior.

Network Intrusion Detection and Countermeasure Selection

Pramod M Mithyantha

This document presents an overview of a project titled "Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems". It discusses the need for effective intrusion detection and response systems to identify attacks in cloud systems and minimize their impact. It introduces NICE, a proposed multi-phase distributed mechanism that uses attack graph models and virtual network countermeasures. NICE includes network intrusion detection agents that monitor traffic and vulnerabilities. When threats are detected, countermeasures like packet inspection or virtual network reconfigurations are deployed.

Identifying attack propagation patterns in Honeypots using Markov Chains Mode...

Preeti M Sobarad

Identifying attack propagation patterns in Honeypots using Markov Chains Modelling and Complex Networks analysis Honeypot frameworks (a set of deployed and monitored Honeypots) are designed to attract attackers by presenting false or misleading information that an attacker will want to gain, attack or control. Honeypot propagation models try to detect phenomena that reflect the propagation of attacks through different honeypots in the system. Here we use a two-phased method for modeling honeypot propagation patterns within a honeypot framework. They are, 1. Markov Chains 2. Complex network analysis OBJECTIVES: 1. The probability distribution of the next expected attacked honeypot in an attack session. 2. The Honeypots that are co-attacked together. 3. To know about the attack propagation combinations that are considered new and evolving. 4. To know which Honeypots contribute the most to the attack propagation within the framework. 5. To know more about contextual differences between attack propagations.(E.g. Do attack propagation patterns vary by the attacking country?). APPROACH Propagation is said to occur from honeypot to honeypot , when the same attacker attacks immediately after . The suggested model is a propagation graph, where each node represents a honeypot; a link between two nodes represents propagation between two honeypots; and each link is assigned with a probability. PROPOSED MODEL 1. First we give a formal representation to the propagation graph by considering it as the graph representation of a Markov Chains model. 2. Second, we extend it by adding a new layer of analysis methods that are adapted from the Complex networks research area .

Massif cluster meeting

fcleary

The document describes an approach to analytical attack modeling using two main techniques: analytical modeling through generating multi-level attack graphs and service dependencies, and fine-grained modeling and simulation. It then outlines the key components of an attack modeling architecture, including generators for system specifications, attack graphs, and service dependencies, as well as modules for security evaluation, decision support, and interactive visualization.

APPLICATION-LAYER DDOS DETECTION BASED ON A ONE-CLASS SUPPORT VECTOR MACHINE

IJNSA Journal

Application-layer Distributed Denial-of-Service (DDoS) attack takes advantage of the complexity and diversity of network protocols and services. This kind of attacks is more difficult to prevent than other kinds of DDoS attacks. This paper introduces a novel detection mechanism for application-layer DDoS attack based on a One-Class Support Vector Machine (OC-SVM). Support vector machine (SVM) is a relatively new machine learning technique based on statistics. OC-SVM is a special variant of the SVM and since only the normal data is required for training, it is effective for detection of application-layer DDoS attack. In this detection strategy, we first extract 7 features from normal users’ sessions. Then, we build normal users’ browsing models by using OC-SVM. Finally, we use these models to detect application-layer DDoS attacks. Numerical results based on simulation experiments demonstrate the efficacy of our detection method.

012

chatakondu karthik uday bhaskar

This document describes a system for alert aggregation of cyber attacks and intrusions using generative data stream modeling. The system aims to reduce false positive and negative alerts by correlating alerts that exhibit similar patterns into single meta-alerts. It also aims to distinguish between different instances of the same attack type. The system architecture includes layers for detection, alert processing, and reaction. It evaluates intrusions using the KDD dataset and detects attacks falling into categories like probing, DoS, U2R, and R2L.

Anomaly detection final

Akshay Bansal

This project aims to analyze and emulate anomaly detection techniques for low-rate TCP denial of service attacks using the DETERLab testbed. The researchers plan to design an extensive anomaly checkpoint detection methodology. They propose a modified likelihood ratio algorithm to detect changes in network traffic statistics. The algorithm will be tested on legitimate and attack traffic in DETERLab while analyzing detection statistics and congestion windows. Results will help evaluate the ability to rapidly detect attacks while limiting false alarms.

Machine learning techniques applied to detect cyber attacks on web applications

Venkat Projects

This document discusses using machine learning techniques to detect cyber attacks on web applications. It proposes using a graph-based approach and regular expressions to model normal HTTP request behavior during a learning phase. This would establish a baseline for detecting anomalies and potential attacks. Existing approaches are also reviewed that use algorithms like NSG, LSEG and F-Sign to generate signatures for detecting malware based on network traffic patterns or software code. Supervised machine learning methods have also been applied using features extracted from network data and classifiers like k-NN, Naive Bayes and neural networks. The proposed system would adapt this machine learning paradigm to specifically detect attacks on web applications.

Machine learning techniques applied to detect cyber attacks on web applications

Venkat Projects

Machine learning techniques applied to detect cyber attacks on web applications The increased usage of cloud services, growing number of web applications users, changes in network infrastructure that connects devices running mobile operating systems and constantly evolving network technology cause novel challenges for cyber security. As a result, to counter arising threats, network security mechanisms, sensors and protection schemes also have to evolve, to address the needs and problems of the users. In this article, we focus on countering emerging application layer cyber attacks since those are listed as top threats and the main challenge for network and cyber security. The major contribution of the article is the proposition of machine learning approach to model normal behaviour of application and to detect cyber attacks. The model consists of patterns (in form of Perl Compatible Regular Expressions (PCRE) regular expressions) that are obtained using graph-based segmentation technique and dynamic programming. The model is based on information obtained from HTTP requests generated by client to a web server. We have evaluated our method on CSIC 2010 HTTP Dataset achieving satisfactory results.

A Review Of Network Security Metrics

Lisa Riley

This document discusses network security metrics based on attack graphs. It provides background on attack graphs and how they can be used to analyze network security vulnerabilities. Attack graphs model relationships between vulnerabilities and how attackers could progress through a network. The document proposes several new network security metrics based on attack graphs, such as the K-step Condition Accumulation metric, and presents a new method for measuring network security that involves generating attack graphs, reducing them, and evaluating network security. Future work is needed to develop models for applying attack graphs to individual hosts and to formalize relationships between attributes and attackability.

Understanding Intrusion Detection & Prevention Systems (1).pptx

Rineri1

Investigation of detection & prevention sinkhole attack in manet

ijctet

This document discusses sinkhole attacks in mobile ad hoc networks (MANETs) and wireless sensor networks (WSNs). It provides background on sinkhole attacks, where a compromised node advertises a high quality route to attract network traffic. This can disrupt data transmission to the base station. The document reviews several existing detection techniques for sinkhole attacks, including algorithms using hop counting and mobile agents. It then proposes a new lightweight algorithm to detect sinkhole attacks in MANETs using network flow information collected by the base station and analysis of routing patterns to identify the intruder. The algorithm aims to provide secure and efficient sinkhole detection with low overhead.

Intrusion Detection System Using Self Organizing Map Algorithms

Editor IJCATR

This document presents a study on using self-organizing map (SOM) algorithms for intrusion detection systems. The study explores using SOM, an artificial neural network technique, to map high-dimensional network traffic data onto a 2D space to detect anomalies and network attacks. The authors describe the SOM algorithm and evaluate its performance on detecting different types of attacks in a test data set with an accuracy of 50.07% and a false positive rate of 0.06%. The study demonstrates the potential of SOM for building intrusion detection systems capable of handling complex network traffic data.

Image Morphing: A Literature Study

Editor IJCATR

Image morphing has been the subject of much attention in recent years. It has proven to be a powerful visual effects tool in film and television, depicting the fluid transformation of one digital image into another. This paper reviews the growth of this field and describes recent advances in image morphing in terms of three areas: feature specification, warp generation methods, and transition control. These areas relate to the ease of use and quality of results. We will describe the role of radial basis functions, thin plate splines, energy minimization, and multilevel free-form deformations in advancing the state-of-the-art in image morphing. A comparison of various techniques for morphing one digital image in to another is made. We will compare various morphing techniques such as Feature based image morphing, Mesh and Thin Plate Splines based image morphing based on different attributes such as Computational Time, Visual Quality of Morphs obtained and Complexity involved in Selection of features. We will demonstrate the pros and cons of various techniques so as to allow the user to make an informed decision to suit his particular needs. Recent work on a generalized framework for morphing among multiple images will be described.

Intrusion Detection System Using Self Organizing Map Algorithms

Editor IJCATR

With the rapid expansion of computer usage and computer network the security of the computer system has became very important. Every day new kind of attacks are being faced by industries. Many methods have been proposed for the development of intrusion detection system using artificial intelligence technique. In this paper we will have a look at an algorithm based on neural networks that are suitable for Intrusion Detection Systems (IDS). The name of this algorithm is "Self Organizing Maps" (SOM). So far, many different methods have been used to build a detector that Wide variety of different ways in the covers. Among the methods used to detect attacks in intrusion detection is done, In this paper we investigate the Self-Organizing Map method.

Secure intrusion detection and attack measure selection

Uvaraj Shan

This document proposes NICE, a framework for secure intrusion detection and attack mitigation in virtual network systems. NICE uses distributed agents on cloud servers to monitor traffic, detect vulnerabilities, and generate attack graphs. It profiles virtual machines to identify their state and vulnerabilities. When potential attacks are detected, NICE can quarantine suspicious VMs and inspect their traffic. The attack analyzer correlates alerts, constructs attack graphs, and selects appropriate countermeasures based on the graphs. Evaluations show NICE can effectively detect attacks while minimizing performance overhead for the cloud system.

Secure intrusion detection and attack measure selection in virtual network sy...

Uvaraj Shan

Threat_actors_and_vectors_with_whiiteandblack_boxtesting.pptx

gagandeepsinfosec

on false data-injection attacks against power system state estimation modelin...

swathi78

GAN introduction.pptx

Information security

Recommended

Recommended

More Related Content

Similar to Information security

Similar to Information security (20)

More from Kishor Datta Gupta

More from Kishor Datta Gupta (20)

Recently uploaded

Recently uploaded (20)

Information security