Performance Assessment of Network Intrusion-Alert Prediction
Approved for public release; distribution is unlimited === In the current global cyber warfare landscape, cyber attacks on infrastructure are a serious threat. Although network administrators use intrusion detection systems (IDSs) to detect threats and anomalies, they usually only offer post-attacks...
Main Author: | |
---|---|
Other Authors: | |
Published: |
Monterey, California. Naval Postgraduate School
2012
|
Online Access: | http://hdl.handle.net/10945/17384 |
id |
ndltd-nps.edu-oai-calhoun.nps.edu-10945-17384 |
---|---|
record_format |
oai_dc |
spelling |
ndltd-nps.edu-oai-calhoun.nps.edu-10945-173842015-08-06T16:03:02Z Performance Assessment of Network Intrusion-Alert Prediction Khong, Farn Wei Jason Darken, Christian J. Rowe, Neil C. Tan, Kian-Moh Terence Modeling, Virtual Environments, and Simulation (MOVES) Approved for public release; distribution is unlimited In the current global cyber warfare landscape, cyber attacks on infrastructure are a serious threat. Although network administrators use intrusion detection systems (IDSs) to detect threats and anomalies, they usually only offer post-attacks alerts. If we could predict malicious activities, we could allow network administrators or security enhancing software to take appropriate actions in advance of damage occurring. Incoming intrusion detection alerts can be considered as a sequence. We used Pytbull to simulate cyber attacks within a testbed network environment and collected Snort generated intrusion detection alerts. We tested four sets of alert-prediction programs with this data Single-Scope Blending algorithm, a Simple Bayesian Mixture algorithm, a Multiple Simple Bayesian algorithm and a Variable Markov Model algorithm. The harmonic mean of the precision and recall (F-score) measured prediction accuracy. The Single-Scope Blending algorithm performed the best in these tests, especially in a multiple attacker environment. 2012-11-14T00:02:39Z 2012-11-14T00:02:39Z 2012-09 Thesis http://hdl.handle.net/10945/17384 Monterey, California. Naval Postgraduate School |
collection |
NDLTD |
sources |
NDLTD |
description |
Approved for public release; distribution is unlimited === In the current global cyber warfare landscape, cyber attacks on infrastructure are a serious threat. Although network administrators use intrusion detection systems (IDSs) to detect threats and anomalies, they usually only offer post-attacks alerts. If we could predict malicious activities, we could allow network administrators or security enhancing software to take appropriate actions in advance of damage occurring. Incoming intrusion detection alerts can be considered as a sequence. We used Pytbull to simulate cyber attacks within a testbed network environment and collected Snort generated intrusion detection alerts. We tested four sets of alert-prediction programs with this data Single-Scope Blending algorithm, a Simple Bayesian Mixture algorithm, a Multiple Simple Bayesian algorithm and a Variable Markov Model algorithm. The harmonic mean of the precision and recall (F-score) measured prediction accuracy. The Single-Scope Blending algorithm performed the best in these tests, especially in a multiple attacker environment. |
author2 |
Darken, Christian J. |
author_facet |
Darken, Christian J. Khong, Farn Wei Jason |
author |
Khong, Farn Wei Jason |
spellingShingle |
Khong, Farn Wei Jason Performance Assessment of Network Intrusion-Alert Prediction |
author_sort |
Khong, Farn Wei Jason |
title |
Performance Assessment of Network Intrusion-Alert Prediction |
title_short |
Performance Assessment of Network Intrusion-Alert Prediction |
title_full |
Performance Assessment of Network Intrusion-Alert Prediction |
title_fullStr |
Performance Assessment of Network Intrusion-Alert Prediction |
title_full_unstemmed |
Performance Assessment of Network Intrusion-Alert Prediction |
title_sort |
performance assessment of network intrusion-alert prediction |
publisher |
Monterey, California. Naval Postgraduate School |
publishDate |
2012 |
url |
http://hdl.handle.net/10945/17384 |
work_keys_str_mv |
AT khongfarnweijason performanceassessmentofnetworkintrusionalertprediction |
_version_ |
1716816321088323584 |