تجسم حملات سایبری با تخمین خسارت و ترکیب قابلیت و فرصت مهاجم بر اساس مدل انتقال باور

نوع مقاله : مقاله پژوهشی

نویسندگان

دانشگاه صنعتی مالک اشتر

چکیده

در حال حاضر ابزارهای مختلفی برای ثبت رویدادها و هشدارهای موجود در شبکه‌ها وجود دارد. با‌این‌وجود، نیاز به سامانه‌ای که بتوان به ‌کمک آن اطلاعات جمع‌آوری‌شده از تمام این منابع را به‌درستی کنار یکدیگر قرار داد و از ترکیب این اطلاعات تصمیم‌های درست اتخاذ نمود، کاملاً محسوس است. اگر قبل از حمله‌ی مهاجمین بتوان آن را پیش‌بینی نمود و اثرات آن را تخمین زد، راهبرد دفاعی مشخص‌تری انتخاب خواهد شد و می‌توان به میزان قابل‌توجهی خسارات را کاهش داد. تجسم حملات سایبری، پیش‌بینی حملات بر اساس یک چارچوب کاری مشخص است. برای این کار می‌توان از روش‌های مختلف ریاضی بهره جست. یکی از این روش‌ها، مدل انتقال باور است. در این پژوهش با استفاده از مدل انتقال باور از دادگان موجود در سطح بالا که همگی رد حمله هستند بهره گرفته‌ایم و با ترکیب قابلیت و فرصت مهاجم که از مؤلفه‌های تجسم حملات سایبری هستند، وضعیت آتی حملات را پیش‌بینی نموده‌ایم. الگوریتم پیشنهادی این پژوهش نسبت به الگوریتم قبلی ارائه‌شده در مرکز ادغام اطلاعات دانشگاه صنعتی مالک اشتر، به‌طور متوسط 7% بهبود داشته است.

کلیدواژه‌ها


عنوان مقاله [English]

Projection of Cyber Attacks using Damage Estimation and Combination of Attacker’s Capability and Opportunity based on Transferable Belief Model

نویسندگان [English]

  • Ali Jabbar Rashidi
  • Majid Jafari
  • Koroosh Dadashtabar Ahmadi
چکیده [English]

"Nowadays there are so many tools available for capturing the events and alerts within networks. The need for a system that could aggregate the information generated by these tools and combine them to make    better decisions is strongly acknowledged. If we could predict cyber attacks and estimate their effects     before they actually occur, we would be able to apply a better defense strategy and reduce the damage to our critical assets. The projection of cyber attacks is to predict them based on a certain framework using mathematical methods. One of these methods is the Transferable Belief Model (TBM). In this paper, we used the TBM to combine capability and opportunity of attackers - which are cyber attacks' projection  components- to project the future situation of attacks. We have also tested our results against our  customized high-level attack tracks dataset. The result of comparison between our algorithm and the  previously presented algorithm at the Information Fusion Centre of Malek-Ahstar University of Technology shows an average improvement of 7%.
 

کلیدواژه‌ها [English]

  • Cyber Attacks Projection
  • Situation Awareness
  • Damage Estimation
  • Capability
  • Opportunity
  • Transferable Belief Model
[1]     A. J. Rashidi, K. Dadashtabar Ahmadi, and F. Samsami Khodad, “Projection of Muli Stage Cyber Attack Based on Transferable Belief Model and FuzzyInference,” Journal of Electronical & Cyber Defence,vol. 3, no. 2, Serial No. 10, 2015 (In Persian).##
[2]     M. R. Endsley, “Design and Evaluation for Situation Awareness Enhancement,” Proceedings of the 32nd Annual Meeting of the Human Factors Society, pp. 97–101, 1998##.
[3]     J. J. Salerno, M. Sudit, S. J. Yang, G. P. Tadda, I. Kadar, and J. Holsopple, “Issues and Challenges in Higher Level Fusion: Threat/Impact Assessment and Intent Modeling (A Panel Summary),” IEEE Information Fusion (FUSION )13th Conference, July 2010.##
 
[4]     D. Fava, S. R. Byers, and S. J. Yang, “Projecting Cyber Attacks through Variable Length Markov Models,” IEEE Transactions on Information Forensics and Security, vol. 3, Issue 3, September 2008##.
[5]     J. Holsopple, M. Nusinov, D. Liu, H. Du, S. J. Yang, and M. Sudit, “Enhancing Situation Awareness via Automated Situation Assessment,” IEEE Communication Magazine, March 2010.##
[6]     A. D’Amico, L. Buchanan, and J. Goodall, “Mission Impact of Cyber Events: Scenarios and Ontology to Express the Relationships between Cyber Assets, Missions, and Users,” fifth International Conference on Information Warfare and Security, 8-9 Apr. 2010.##
[7]     J. Holsopple and S. J. Yang, “FuSIA: Future Situation and Impact Awareness,” inProceedings of the 11th ISIF/IEEE InternationalConference on Information Fusion, Cologne, Germany, July1-3, 2008.##
[8]     J. Kipp, L. Grau, K. Prinslow, and D. Smith, “The Human Terrain System: A CORDS for the 21st Century,” Military Review, September 2006##.
[9]     R. J. Gonzalez, “Human Terrain, Past, Present, and Future Applications,” Anthropology Today, vol. 24, no 1, February 2008##.
[10]  J. Holsopple, B. Argauer, and S. J. Yang, “Virtual terrain: a common representation of acomputer network,” in Proceedings of SPIE Security and Defense Symposium, Data Mining, Intrusion Detection, Information Assurance, and Data Networks Security Conference, Orlando, FL, March     16-20, 2008##.
[11]  A. E. Khalili, B. Michalk, L. Gilbert, and L. Alford, “Situational Awareness and mission Risk in computer networks,” Proceedings of SPIE Security and Defense Symposium, Cyber Security, Situation Management, and Impact Assessment II Conference (7709A), Orlando FL, 5-9 April 2010##.
[12]  E. Bosse, J. Roy, and S. Wark, “Concepts, Models, and Tools for Information Fusion,” Artech House, Inc, ISBN-13: 978-1- 59693-081-0, p. 4, 2007.##
[13]  A. Steinberg, C. Bowman, and F. White, “Revisions to the JDL Data Fusion Model,” presented at the Joint NATO/IRIS Conference, Quebec, October 1998##.
[14]  J. Salerno, M. Hinman, and D. Boulware, “A Situation Awareness Model Applied to Multiple Domains,” Proceedings of the Defense and Security Conference, Orlando FL, March 2005##.
[15]  S. J. Yang, S. Byers, J. Holsopple, B. Argauer, and D. Fava, “Intrusion Activity Projection for Cyber Situational Awareness,” in Proceedings of IEEE International Conferences on Intelligence and Security Informatics, Taipei, Taiwan, June 17-20, 2008##.
[16]  H. Du, D. F. Liu, J. Holsopple, and S. J Yang, “Toward Ensemble Characterization and Projection of Multistage Cyber Attacks,” IEEE ICCCN, Zürich, Switzerland, August 2-5, pp. 1-8, 2010.##
[17]  M. R. Grimaila, R. F. Mills, and L. W. Fortson, “An Automated Information Asset Tracking Methodology to Enable Timely Cyber Incident Mission Impact Assessment,” 13th International Command and Control Research and Technology Symposia (ICCRTS 2008), Seattle, WA, 17-19 Jun, 2008.##