Predictive Methods in Cyber Defense: Current Experience and Research Challenges

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F21%3A00120728" target="_blank" >RIV/00216224:14610/21:00120728 - isvavai.cz</a>

Nalezeny alternativní kódy

RIV/63839172:_____/20:10133295

Výsledek na webu

<a href="https://www.sciencedirect.com/science/article/abs/pii/S0167739X20329836" target="_blank" >https://www.sciencedirect.com/science/article/abs/pii/S0167739X20329836</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1016/j.future.2020.10.006" target="_blank" >10.1016/j.future.2020.10.006</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Predictive Methods in Cyber Defense: Current Experience and Research Challenges

Popis výsledku v původním jazyce

Predictive analysis allows next-generation cyber defense that is more proactive than current approaches based on intrusion detection. In this paper, we discuss various aspects of predictive methods in cyber defense and illustrate them on three examples of recent approaches. The first approach uses data mining to extract frequent attack scenarios and uses them to project ongoing cyberattacks. The second approach uses a dynamic network entity reputation score to predict malicious actors. The third approach uses time series analysis to forecast attack rates in the network. This paper presents a unique evaluation of the three distinct methods in a common environment of an intrusion detection alert sharing platform, which allows for a comparison of the approaches and illustrates the capabilities of predictive analysis for current and future research and cybersecurity operations. Our experiments show that all three methods achieved a sufficient technology readiness level for experimental deployment in an operational setting with promising accuracy and usability. Namely prediction and projection methods, despite their differences, are highly usable for predictive blacklisting, the first provides a more detailed output, and the second is more extensible. Network security situation forecasting is lightweight and displays very high accuracy, but does not provide details on predicted events.

Název v anglickém jazyce

Predictive Methods in Cyber Defense: Current Experience and Research Challenges

Popis výsledku anglicky

Predictive analysis allows next-generation cyber defense that is more proactive than current approaches based on intrusion detection. In this paper, we discuss various aspects of predictive methods in cyber defense and illustrate them on three examples of recent approaches. The first approach uses data mining to extract frequent attack scenarios and uses them to project ongoing cyberattacks. The second approach uses a dynamic network entity reputation score to predict malicious actors. The third approach uses time series analysis to forecast attack rates in the network. This paper presents a unique evaluation of the three distinct methods in a common environment of an intrusion detection alert sharing platform, which allows for a comparison of the approaches and illustrates the capabilities of predictive analysis for current and future research and cybersecurity operations. Our experiments show that all three methods achieved a sufficient technology readiness level for experimental deployment in an operational setting with promising accuracy and usability. Namely prediction and projection methods, despite their differences, are highly usable for predictive blacklisting, the first provides a more detailed output, and the second is more extensible. Network security situation forecasting is lightweight and displays very high accuracy, but does not provide details on predicted events.

Druh

J_imp - Článek v periodiku v databázi Web of Science

CEP obor

—

OECD FORD obor

10200 - Computer and information sciences

Projekt

<a href="/cs/project/EF16_019%2F0000822" target="_blank" >EF16_019/0000822: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2021

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název periodika

Future Generation Computer Systems

ISSN

0167-739X

e-ISSN

—

Svazek periodika

115

Číslo periodika v rámci svazku

February

Stát vydavatele periodika

NL - Nizozemsko

Počet stran výsledku

14

Strana od-do

517-530

Kód UT WoS článku

000591438900018

EID výsledku v databázi Scopus

2-s2.0-85092215125