Differentiating and Predicting Cyberattack Behaviors Using LSTM

Classifying and predicting cyberattack behaviors are outstanding challenges due to the changing and broad attack surfaces as attackers penetrate into enterprise networks. The rise of Recurrent Neural Networks (RNNs) for temporally structured data in machine learning presents an opportunity to addres...

Ausführliche Beschreibung

Gespeichert in:
Bibliographische Detailangaben
Veröffentlicht in:2018 IEEE Conference on Dependable and Secure Computing (DSC) S. 1 - 8
Hauptverfasser: Perry, Ian, Li, Lutzu, Sweet, Christopher, Su, Shao-Hsuan, Cheng, Fu-Yuan, Yang, Shanchieh Jay, Okutan, Ahmet
Format: Tagungsbericht
Sprache:Englisch
Veröffentlicht: IEEE 01.12.2018
Schlagworte:
Computer architecture
Cyberattack
Data models
Microprocessors
Predictive models
Recurrent neural networks
Training
Online-Zugang:Volltext
Tags: Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
Beschreibung
Zusammenfassung:Classifying and predicting cyberattack behaviors are outstanding challenges due to the changing and broad attack surfaces as attackers penetrate into enterprise networks. The rise of Recurrent Neural Networks (RNNs) for temporally structured data in machine learning presents an opportunity to address these challenges, though it would require sufficient data and reasonable labels indicative of attack behaviors. This paper presents the use of RNNs to model penetration behaviors exhibited by ten teams in the 2017 Collegiate Penetration Testing Competition (CPTC'17). The Long-Short-Term-Memory (LSTM) models obtained by training on the CPTC data enable the assessment of the differentiability of attack behaviors across teams and the predictability of future actions. This first-of-its kind attempt presents observations and insights for how earlier attack actions may or may not be indicative of future behaviors. The paper concludes with future considerations to integrate the LSTM models and enable predictive analytics to defend against complex, multistage cyberattacks.
DOI:10.1109/DESEC.2018.8625145