Sequential pattern mining for ICT risk assessment and management
| Autor: | Fabrizio Baiardi, Jacopo Lipilini, Michele D’Andreagiovanni, Federico Tonelli, Salvatore Ruggieri |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
Class (computer programming)
Cover (telecommunications) Sequence database security data mining attack sequence pattern Logic Computer science Suite security data mining 0102 computer and information sciences pattern computer.software_genre 01 natural sciences Partition (database) Theoretical Computer Science Set (abstract data type) attack sequence Computational Theory and Mathematics 010201 computation theory & mathematics Data analysis Isolation (database systems) Data mining computer Software |
| Zdroj: | Journal of Logical and Algebraic Methods in Programming. 102:1-16 |
| ISSN: | 2352-2208 |
| DOI: | 10.1016/j.jlamp.2018.09.007 |
| Popis: | ICT risk assessment and management relies on the analysis of data on the joint behavior of a target system and its attackers. The tools in the Haruspex suite model intelligent, goal-oriented attackers that reach their goals through sequences of attacks. The tools synthetically generate these sequences through a Monte Carlo method that runs multiple simulations of the attacker behavior. This paper presents a sequential pattern mining analysis of the attack sequence database to extract a high-level and succinct understanding of the attacker strategies against the system to assess. Such an understanding is expressed as a set of sequential patterns that cover, and possibly partition, the attack sequences. This set can be extracted in isolation, or in contrast with the behavior of other attackers. In the latter case, the patterns represent a signature of the behavior of an attacker. The dynamic tools of the suite use this signature to deploy dynamic counter-measures that reduce the security risk. We formally motivate the need for using the class of maximal sequential patterns in covering attack sequences, instead of frequent or closed sequential patterns. When contrasting the behavior of different attackers, we resort to distinguishing sequential patterns. We report an extensive experimentation on a system with 36 nodes, 6 attackers, and 600K attack sequences. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect