Recent years have witnessed the rise of Internet-of-Things
(IoT) based cyber attacks. These attacks, as expected, are
launched from compromised IoT devices by exploiting security
flaws already known. Less clear, however, are the fundamental
causes of the pervasiveness of IoT device vulnerabilities
and their security implications, particularly in how
they affect ongoing cybercrimes. To better understand the
problems and seek effective means to suppress the wave of
IoT-based attacks, we conduct a comprehensive study based
on a large number of real-world attack traces collected from
our honeypots, attack tools purchased from the underground,
and information collected from high-profile IoT attacks. This
study sheds new light on the device vulnerabilities of today’s
IoT systems and their security implications: ongoing cyber
attacks heavily rely on these known vulnerabilities and the
attack code released through their reports; on the other hand,
such a reliance on known vulnerabilities can actually be used
against adversaries. The same bug reports that enable the development
of an attack at an exceedingly low cost can also be
leveraged to extract vulnerability-specific features that help
stop the attack. In particular, we leverage Natural Language
Processing (NLP) to automatically collect and analyze more
than 7,500 security reports (with 12,286 security critical IoT
flaws in total) scattered across bug-reporting blogs, forums,
and mailing lists on the Internet. We show that signatures
can be automatically generated through an NLP-based report
analysis, and be used by intrusion detection or firewall systems
to effectively mitigate the threats from today’s IoT-based
attacks.
more »
« less
Employing attack graphs for intrusion detection
Intrusion detection systems are a commonly deployed defense that
examines network traffic, host operations, or both to detect attacks.
However, more attacks bypass IDS defenses each year, and with the
sophistication of attacks increasing as well, we must examine new
perspectives for intrusion detection. Current intrusion detection
systems focus on known attacks and/or vulnerabilities, limiting
their ability to identify new attacks, and lack the visibility into all
system components necessary to confirm attacks accurately, particularly
programs. To change the landscape of intrusion detection,
we propose that future IDSs track how attacks evolve across system
layers by adapting the concept of attack graphs. Attack graphs were
proposed to study how multi-stage attacks could be launched by
exploiting known vulnerabilities. Instead of constructing attacks
reactively, we propose to apply attack graphs proactively to detect
sequences of events that fulfill the requirements for vulnerability
exploitation. Using this insight, we examine how to generate modular
attack graphs automatically that relate adversary accessibility
for each component, called its attack surface, to flaws that provide
adversaries with permissions that create threats, called attack states,
and exploit operations from those threats, called attack actions. We
evaluate the proposed approach by applying it to two case studies:
(1) attacks on file retrieval, such as TOCTTOU attacks, and
(2) attacks propagated among processes, such as attacks on Shellshock
vulnerabilities. In these case studies, we demonstrate how to
leverage existing tools to compute attack graphs automatically and
assess the effectiveness of these tools for building complete attack
graphs. While we identify some research areas, we also find several
reasons why attack graphs can provide a valuable foundation for
improving future intrusion detection systems.
more »
« less
- NSF-PAR ID:
- 10163950
- Date Published:
- Journal Name:
- New Security Paradigms Workshop
- Page Range / eLocation ID:
- 16 to 30
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
Recent years have witnessed the rise of Internet-of-Things (IoT) based cyber attacks. These attacks, as expected, are launched from compromised IoT devices by exploiting security flaws already known. Less clear, however, are the fundamental causes of the pervasiveness of IoT device vulnerabilities and their security implications, particularly in how they affect ongoing cybercrimes. To better understand the problems and seek effective means to suppress the wave of IoT-based attacks, we conduct a comprehensive study based on a large number of real-world attack traces collected from our honeypots, attack tools purchased from the underground, and information collected from high-profile IoT attacks. This study sheds new light on the device vulnerabilities of today's IoT systems and their security implications: ongoing cyber attacks heavily rely on these known vulnerabilities and the attack code released through their reports; on the other hand, such a reliance on known vulnerabilities can actually be used against adversaries. The same bug reports that enable the development of an attack at an exceedingly low cost can also be leveraged to extract vulnerability-specific features that help stop the attack. In particular, we leverage Natural Language Processing (NLP) to automatically collect and analyze more than 7,500 security reports (with 12,286 security critical IoT flaws in total) scattered across bug-reporting blogs, forums, and mailing lists on the Internet. We show that signatures can be automatically generated through an NLP-based report analysis, and be used by intrusion detection or firewall systems to effectively mitigate the threats from today's IoT-based attacks.more » « less
-
null (Ed.)Cyber-threats are continually evolving and growing in numbers and extreme complexities with the increasing connectivity of the Internet of Things (IoT). Existing cyber-defense tools seem not to deter the number of successful cyber-attacks reported worldwide. If defense tools are not seldom, why does the cyber-chase trend favor bad actors? Although cyber-defense tools monitor and try to diffuse intrusion attempts, research shows the required agility speed against evolving threats is way too slow. One of the reasons is that many intrusion detection tools focus on anomaly alerts’ accuracy, assuming that pre-observed attacks and subsequent security patches are adequate. Well, that is not the case. In fact, there is a need for techniques that go beyond intrusion accuracy against specific vulnerabilities to the prediction of cyber-defense performance for improved proactivity. This paper proposes a combination of cyber-attack projection and cyber-defense agility estimation to dynamically but reliably augur intrusion detection performance. Since cyber-security is buffeted with many unknown parameters and rapidly changing trends, we apply a machine learning (ML) based hidden markov model (HMM) to predict intrusion detection agility. HMM is best known for robust prediction of temporal relationships mid noise and training brevity corroborating our high prediction accuracy on three major open-source network intrusion detection systems, namely Zeek, OSSEC, and Suricata. Specifically, we present a novel approach for combined projection, prediction, and cyber-visualization to enable precise agility analysis of cyber defense. We also evaluate the performance of the developed approach using numerical results.more » « less
-
One of the effective ways of detecting malicious traffic in computer networks is intrusion detection systems (IDS). Though IDS identify malicious activities in a network, it might be difficult to detect distributed or coordinated attacks because they only have single vantage point. To combat this problem, cooperative intrusion detection system was proposed. In this detection system, nodes exchange attack features or signatures with a view of detecting an attack that has previously been detected by one of the other nodes in the system. Exchanging of attack features is necessary because a zero-day attacks (attacks without known signature) experienced in different locations are not the same. Although this solution enhanced the ability of a single IDS to respond to attacks that have been previously identified by cooperating nodes, malicious activities such as fake data injection, data manipulation or deletion and data consistency are problems threatening this approach. In this paper, we propose a solution that leverages blockchain’s distributive technology, tamper-proof ability and data immutability to detect and prevent malicious activities and solve data consistency problems facing cooperative intrusion detection. Focusing on extraction, storage and distribution stages of cooperative intrusion detection, we develop a blockchain-based solution that securely extracts features or signatures, adds extra verification step, makes storage of these signatures and features distributive and data sharing secured. Performance evaluation of the system with respect to its response time and resistance to the features/signatures injection is presented. The result shows that the proposed solution prevents stored attack features or signature against malicious data injection, manipulation or deletion and has low latency.more » « less
-
Host-based Intrusion Detection Systems (HIDS) automatically detect events that indicate compromise by adversarial applications. HIDS are generally formulated as analyses of sequences of system events such as bash commands or system calls. Anomaly-based approaches to HIDS leverage models of normal (a.k.a. baseline) system behavior to detect and report abnormal events and have the advantage of being able to detect novel attacks. In this article, we develop a new method for anomaly-based HIDS using deep learning predictions of sequence-to-sequence behavior in system calls. Our proposed method, called the ALAD algorithm, aggregates predictions at the application level to detect anomalies. We investigate the use of several deep learning architectures, including WaveNet and several recurrent networks. We show that ALAD empowered with deep learning significantly outperforms previous approaches. We train and evaluate our models using an existing dataset, ADFA-LD, and a new dataset of our own construction, PLAID. As deep learning models are black box in nature, we use an alternate approach, allotaxonographs, to characterize and understand differences in baseline vs. attack sequences in HIDS datasets such as PLAID.more » « less
- Free Publicly Accessible Full Text
-
Accepted Manuscript1.0
- Conference Paper:
- https://doi.org/10.1145/3368860.3368862
