{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/108614"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/108614","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Information-fusion-based methods to improve the detection of advanced cyber threats","abstract":"The increasing adoption of information and communication technologies in every aspect of modern life has made the security of networked systems more crucial. Their growing size and complexity have provided adversaries with a larger attack surface leading to numerous breaches in recent years that have undermined the confidentiality and availability of such systems. Thus, it is essential to improve security solutions to protect systems against malicious threats. Intrusion detection is an essential strategy that, together with intrusion prevention and response, make systems more resilient against malicious access. The challenges that are faced while developing intrusion detection systems (IDSes) are manifold. First, the malicious actors are continuously revising their tactics in using the victim's infrastructure against itself. Next, to address the threats, organizations need to employ many layers of security products. The information generated by these products poses significant technical and processing overheads. Finally, security systems need to adapt according to the nature of the target network and constraints of the services delivered. In this dissertation, we improve the detection of advanced cyber threats that use intelligent planning and persistent actions in compromising large networked systems. In particular, we design and implement threat detection methods that utilize information fusion. Information fusion guides the analysis and incremental refinement of monitoring information to obtain more accurate detections and smaller volumes of alerts. The general framework of the presented methods is as follows. We collect security monitoring information by using a range of host- and network-level monitors. We then refine that monitoring information by identifying and extracting useful features. The features then drive anomaly-based and specification-based detection of attacks to provide alerts and improve visibility into the target network. We develop techniques that apply to general networked systems. However, to make the discussion concrete and reason about our design decisions, we have adopted two types of target systems: an enterprise IT network and a power grid substation network. These systems offer different types of architectures and security requirements, encompassing a wide variety of networked systems. Nevertheless, the possible types of attacks are similar. We set out to detect vectors of initial compromises, such as network scans, network-layer distributed denial-of-service, and malware presence on hosts. In our approach, we combine the host-level context, which is captured by monitors such as system logging deployed on individual hosts, with the network-level context captured by monitors such as firewalls, and we use the aggregated profile in detecting anomalous behavior. The detection of abnormal behavior uses unsupervised cluster analysis. We devise a method to order the anomalous clusters in terms of their likely maliciousness, which can help a security administrator prioritize the clusters to investigate manually. Our experiments using an enterprise network dataset demonstrate that our approach has higher accuracy of detection than any individual monitors alone. Further, our completely unsupervised approach detects more attacks and generates a smaller volume of alerts than a state-of-the-art rule-based IDS, Snort. We then introduce a novel technique to detect malicious lateral movement (LM). The LM attackers use the already compromised entities (e.g., hosts, accounts, and services) as stepping stones for reaching critical segments. The process of expansion usually happens in conjunction with command and control (C&C) to gather internal system structure information and carry out a damaging action. To effectively detect such attacks, we first build a graph-based model to represent the current state of the network. Guided by the model, we identify the essential features of C&C and LM activities and extract them from internal and external communication traffic. Driven by the analysis of the features, we propose to use an ensemble of multiple anomaly detection techniques to identify compromised hosts. Our experiments using enterprise network traces show that our approach can detect the attacks with high accuracy and a low false-alarm rate even when the attacker's behavior is similar to benign behavior. We then study the advanced attack detection when it is in the last stage before launching a harmful action. With false data injection on IEC 61850-compliant substations as our use case, we design and implement a system to detect the attack within the strict timing constraints. We first develop an algorithm to identify poisoning attacks on GOOSE protocol. The algorithm performs a highly-stateful analysis of traffic to reason about ongoing communication's properties in the context of protocol specifications. We then use a novel combination of whitelisting, specification-based analysis, and physical behavior attributes to detect with high accuracy a broad class of false data injection attacks. Our experiments using substation network traces show that the system can identify attacker-injected messages even if they resemble benign communication patterns. We discuss software and hardware bottlenecks, devise a systematic approach to improve our IDS's performance, and demonstrate its applicability to high-speed protection-related communication.","abstract_html":"The increasing adoption of information and communication technologies in every aspect of modern life has made the security of networked systems more crucial. Their growing size and complexity have provided adversaries with a larger attack surface leading to numerous breaches in recent years that have undermined the confidentiality and availability of such systems. Thus, it is essential to improve security solutions to protect systems against malicious threats. Intrusion detection is an essential strategy that, together with intrusion prevention and response, make systems more resilient against malicious access. The challenges that are faced while developing intrusion detection systems (IDSes) are manifold. First, the malicious actors are continuously revising their tactics in using the victim's infrastructure against itself. Next, to address the threats, organizations need to employ many layers of security products. The information generated by these products poses significant technical and processing overheads. Finally, security systems need to adapt according to the nature of the target network and constraints of the services delivered. In this dissertation, we improve the detection of advanced cyber threats that use intelligent planning and persistent actions in compromising large networked systems. In particular, we design and implement threat detection methods that utilize information fusion. Information fusion guides the analysis and incremental refinement of monitoring information to obtain more accurate detections and smaller volumes of alerts. The general framework of the presented methods is as follows. We collect security monitoring information by using a range of host- and network-level monitors. We then refine that monitoring information by identifying and extracting useful features. The features then drive anomaly-based and specification-based detection of attacks to provide alerts and improve visibility into the target network. We develop techniques that apply to general networked systems. However, to make the discussion concrete and reason about our design decisions, we have adopted two types of target systems: an enterprise IT network and a power grid substation network. These systems offer different types of architectures and security requirements, encompassing a wide variety of networked systems. Nevertheless, the possible types of attacks are similar. We set out to detect vectors of initial compromises, such as network scans, network-layer distributed denial-of-service, and malware presence on hosts. In our approach, we combine the host-level context, which is captured by monitors such as system logging deployed on individual hosts, with the network-level context captured by monitors such as firewalls, and we use the aggregated profile in detecting anomalous behavior. The detection of abnormal behavior uses unsupervised cluster analysis. We devise a method to order the anomalous clusters in terms of their likely maliciousness, which can help a security administrator prioritize the clusters to investigate manually. Our experiments using an enterprise network dataset demonstrate that our approach has higher accuracy of detection than any individual monitors alone. Further, our completely unsupervised approach detects more attacks and generates a smaller volume of alerts than a state-of-the-art rule-based IDS, Snort. We then introduce a novel technique to detect malicious lateral movement (LM). The LM attackers use the already compromised entities (e.g., hosts, accounts, and services) as stepping stones for reaching critical segments. The process of expansion usually happens in conjunction with command and control (C&C) to gather internal system structure information and carry out a damaging action. To effectively detect such attacks, we first build a graph-based model to represent the current state of the network. Guided by the model, we identify the essential features of C&C and LM activities and extract them from internal and external communication traffic. Driven by the analysis of the features, we propose to use an ensemble of multiple anomaly detection techniques to identify compromised hosts. Our experiments using enterprise network traces show that our approach can detect the attacks with high accuracy and a low false-alarm rate even when the attacker's behavior is similar to benign behavior. We then study the advanced attack detection when it is in the last stage before launching a harmful action. With false data injection on IEC 61850-compliant substations as our use case, we design and implement a system to detect the attack within the strict timing constraints. We first develop an algorithm to identify poisoning attacks on GOOSE protocol. The algorithm performs a highly-stateful analysis of traffic to reason about ongoing communication's properties in the context of protocol specifications. We then use a novel combination of whitelisting, specification-based analysis, and physical behavior attributes to detect with high accuracy a broad class of false data injection attacks. Our experiments using substation network traces show that the system can identify attacker-injected messages even if they resemble benign communication patterns. We discuss software and hardware bottlenecks, devise a systematic approach to improve our IDS's performance, and demonstrate its applicability to high-speed protection-related communication.","abstract_has_math":false,"creators":["Bohara, Atul"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"Ph.D.","degree_level":"Dissertation","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Sanders, William H.","Nahrstedt, Klara","Caesar, Matthew","Ros-Giralt, Jordi"],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2020,"date_issued":"2020-10-07T22:44:36Z","date_published":"2020-10-07T22:44:36Z","updated_at":"2026-07-22T22:24:48Z","subjects":["cybersecurity","intrusion detection","information fusion","advanced persistent threats","lateral movement","IEC 61850 substation security","GOOSE security","anomaly detection"],"languages":["en"],"rights":["Copyright 2020 Atul Bohara"],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/2142/108614","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Sanders, William H.","Nahrstedt, Klara","Caesar, Matthew","Ros-Giralt, Jordi"]},{"key":"dc:creator","label":"Author","values":["Bohara, Atul"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2020-10-07T22:44:36Z","2022-10-07T22:44:53Z","2020-07-15","2020-08"]},{"key":"dc:type","label":"Dc Type","values":["text","Thesis"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Dissertation"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Ph.D."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["cybersecurity","intrusion detection","information fusion","advanced persistent threats","lateral movement","IEC 61850 substation security","GOOSE security","anomaly detection"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2020 Atul Bohara"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/2142/108614"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["The increasing adoption of information and communication technologies in every aspect of modern life has made the security of networked systems more crucial. Their growing size and complexity have provided adversaries with a larger attack surface leading to numerous breaches in recent years that have undermined the confidentiality and availability of such systems. Thus, it is essential to improve security solutions to protect systems against malicious threats. Intrusion detection is an essential strategy that, together with intrusion prevention and response, make systems more resilient against malicious access. The challenges that are faced while developing intrusion detection systems (IDSes) are manifold. First, the malicious actors are continuously revising their tactics in using the victim's infrastructure against itself. Next, to address the threats, organizations need to employ many layers of security products. The information generated by these products poses significant technical and processing overheads. Finally, security systems need to adapt according to the nature of the target network and constraints of the services delivered. In this dissertation, we improve the detection of advanced cyber threats that use intelligent planning and persistent actions in compromising large networked systems. In particular, we design and implement threat detection methods that utilize information fusion. Information fusion guides the analysis and incremental refinement of monitoring information to obtain more accurate detections and smaller volumes of alerts. The general framework of the presented methods is as follows. We collect security monitoring information by using a range of host- and network-level monitors. We then refine that monitoring information by identifying and extracting useful features. The features then drive anomaly-based and specification-based detection of attacks to provide alerts and improve visibility into the target network. We develop techniques that apply to general networked systems. However, to make the discussion concrete and reason about our design decisions, we have adopted two types of target systems: an enterprise IT network and a power grid substation network. These systems offer different types of architectures and security requirements, encompassing a wide variety of networked systems. Nevertheless, the possible types of attacks are similar. We set out to detect vectors of initial compromises, such as network scans, network-layer distributed denial-of-service, and malware presence on hosts. In our approach, we combine the host-level context, which is captured by monitors such as system logging deployed on individual hosts, with the network-level context captured by monitors such as firewalls, and we use the aggregated profile in detecting anomalous behavior. The detection of abnormal behavior uses unsupervised cluster analysis. We devise a method to order the anomalous clusters in terms of their likely maliciousness, which can help a security administrator prioritize the clusters to investigate manually. Our experiments using an enterprise network dataset demonstrate that our approach has higher accuracy of detection than any individual monitors alone. Further, our completely unsupervised approach detects more attacks and generates a smaller volume of alerts than a state-of-the-art rule-based IDS, Snort. We then introduce a novel technique to detect malicious lateral movement (LM). The LM attackers use the already compromised entities (e.g., hosts, accounts, and services) as stepping stones for reaching critical segments. The process of expansion usually happens in conjunction with command and control (C&C) to gather internal system structure information and carry out a damaging action. To effectively detect such attacks, we first build a graph-based model to represent the current state of the network. Guided by the model, we identify the essential features of C&C and LM activities and extract them from internal and external communication traffic. Driven by the analysis of the features, we propose to use an ensemble of multiple anomaly detection techniques to identify compromised hosts. Our experiments using enterprise network traces show that our approach can detect the attacks with high accuracy and a low false-alarm rate even when the attacker's behavior is similar to benign behavior. We then study the advanced attack detection when it is in the last stage before launching a harmful action. With false data injection on IEC 61850-compliant substations as our use case, we design and implement a system to detect the attack within the strict timing constraints. We first develop an algorithm to identify poisoning attacks on GOOSE protocol. The algorithm performs a highly-stateful analysis of traffic to reason about ongoing communication's properties in the context of protocol specifications. We then use a novel combination of whitelisting, specification-based analysis, and physical behavior attributes to detect with high accuracy a broad class of false data injection attacks. Our experiments using substation network traces show that the system can identify attacker-injected messages even if they resemble benign communication patterns. We discuss software and hardware bottlenecks, devise a systematic approach to improve our IDS's performance, and demonstrate its applicability to high-speed protection-related communication.","Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2022-08-01","The student, Atul Bohara, accepted the attached license on 2020-07-14 at 22:48.","The student, Atul Bohara, submitted this Dissertation for approval on 2020-07-14 at 23:02.","This Dissertation was approved for publication on 2020-07-15 at 09:35.","DSpace SAF Submission Ingestion Package generated from Vireo submission #15625 on 2020-10-02 at 15:33:21","Made available in DSpace on 2020-10-07T22:44:36Z (GMT). No. of bitstreams: 2 BOHARA-DISSERTATION-2020.pdf: 2357983 bytes, checksum: b0b4514c7449d5b11382b50d92e68c07 (MD5) LICENSE.txt: 4208 bytes, checksum: db90d88ba7664a2aa9982bfb8bfefcd0 (MD5) Previous issue date: 2020-07-15","Embargo set by: Seth Robbins for item 116241 Lift date: 2022-10-07T22:44:53Z Reason: Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","U of I Only"]},{"key":"dc:format","label":"Dc Format","values":["application/pdf"]},{"key":"dc:title","label":"Title","values":["Information-fusion-based methods to improve the detection of advanced cyber threats"]}]}],"canonical_facts":{"dc:contributor":["Sanders, William H.","Nahrstedt, Klara","Caesar, Matthew","Ros-Giralt, Jordi"],"dc:creator":["Bohara, Atul"],"dc:date":["2020-10-07T22:44:36Z","2022-10-07T22:44:53Z","2020-07-15","2020-08"],"dc:description":["The increasing adoption of information and communication technologies in every aspect of modern life has made the security of networked systems more crucial. Their growing size and complexity have provided adversaries with a larger attack surface leading to numerous breaches in recent years that have undermined the confidentiality and availability of such systems. Thus, it is essential to improve security solutions to protect systems against malicious threats. Intrusion detection is an essential strategy that, together with intrusion prevention and response, make systems more resilient against malicious access. The challenges that are faced while developing intrusion detection systems (IDSes) are manifold. First, the malicious actors are continuously revising their tactics in using the victim's infrastructure against itself. Next, to address the threats, organizations need to employ many layers of security products. The information generated by these products poses significant technical and processing overheads. Finally, security systems need to adapt according to the nature of the target network and constraints of the services delivered. In this dissertation, we improve the detection of advanced cyber threats that use intelligent planning and persistent actions in compromising large networked systems. In particular, we design and implement threat detection methods that utilize information fusion. Information fusion guides the analysis and incremental refinement of monitoring information to obtain more accurate detections and smaller volumes of alerts. The general framework of the presented methods is as follows. We collect security monitoring information by using a range of host- and network-level monitors. We then refine that monitoring information by identifying and extracting useful features. The features then drive anomaly-based and specification-based detection of attacks to provide alerts and improve visibility into the target network. We develop techniques that apply to general networked systems. However, to make the discussion concrete and reason about our design decisions, we have adopted two types of target systems: an enterprise IT network and a power grid substation network. These systems offer different types of architectures and security requirements, encompassing a wide variety of networked systems. Nevertheless, the possible types of attacks are similar. We set out to detect vectors of initial compromises, such as network scans, network-layer distributed denial-of-service, and malware presence on hosts. In our approach, we combine the host-level context, which is captured by monitors such as system logging deployed on individual hosts, with the network-level context captured by monitors such as firewalls, and we use the aggregated profile in detecting anomalous behavior. The detection of abnormal behavior uses unsupervised cluster analysis. We devise a method to order the anomalous clusters in terms of their likely maliciousness, which can help a security administrator prioritize the clusters to investigate manually. Our experiments using an enterprise network dataset demonstrate that our approach has higher accuracy of detection than any individual monitors alone. Further, our completely unsupervised approach detects more attacks and generates a smaller volume of alerts than a state-of-the-art rule-based IDS, Snort. We then introduce a novel technique to detect malicious lateral movement (LM). The LM attackers use the already compromised entities (e.g., hosts, accounts, and services) as stepping stones for reaching critical segments. The process of expansion usually happens in conjunction with command and control (C&C) to gather internal system structure information and carry out a damaging action. To effectively detect such attacks, we first build a graph-based model to represent the current state of the network. Guided by the model, we identify the essential features of C&C and LM activities and extract them from internal and external communication traffic. Driven by the analysis of the features, we propose to use an ensemble of multiple anomaly detection techniques to identify compromised hosts. Our experiments using enterprise network traces show that our approach can detect the attacks with high accuracy and a low false-alarm rate even when the attacker's behavior is similar to benign behavior. We then study the advanced attack detection when it is in the last stage before launching a harmful action. With false data injection on IEC 61850-compliant substations as our use case, we design and implement a system to detect the attack within the strict timing constraints. We first develop an algorithm to identify poisoning attacks on GOOSE protocol. The algorithm performs a highly-stateful analysis of traffic to reason about ongoing communication's properties in the context of protocol specifications. We then use a novel combination of whitelisting, specification-based analysis, and physical behavior attributes to detect with high accuracy a broad class of false data injection attacks. Our experiments using substation network traces show that the system can identify attacker-injected messages even if they resemble benign communication patterns. We discuss software and hardware bottlenecks, devise a systematic approach to improve our IDS's performance, and demonstrate its applicability to high-speed protection-related communication.","Submission published under a 24 month embargo labeled 'U of I Access', the embargo will last until 2022-08-01","The student, Atul Bohara, accepted the attached license on 2020-07-14 at 22:48.","The student, Atul Bohara, submitted this Dissertation for approval on 2020-07-14 at 23:02.","This Dissertation was approved for publication on 2020-07-15 at 09:35.","DSpace SAF Submission Ingestion Package generated from Vireo submission #15625 on 2020-10-02 at 15:33:21","Made available in DSpace on 2020-10-07T22:44:36Z (GMT). No. of bitstreams: 2 BOHARA-DISSERTATION-2020.pdf: 2357983 bytes, checksum: b0b4514c7449d5b11382b50d92e68c07 (MD5) LICENSE.txt: 4208 bytes, checksum: db90d88ba7664a2aa9982bfb8bfefcd0 (MD5) Previous issue date: 2020-07-15","Embargo set by: Seth Robbins for item 116241 Lift date: 2022-10-07T22:44:53Z Reason: Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","U of I Only"],"dc:format":["application/pdf"],"dc:identifier":["http://hdl.handle.net/2142/108614"],"dc:language":["en"],"dc:rights":["Copyright 2020 Atul Bohara"],"dc:subject":["cybersecurity","intrusion detection","information fusion","advanced persistent threats","lateral movement","IEC 61850 substation security","GOOSE security","anomaly detection"],"dc:title":["Information-fusion-based methods to improve the detection of advanced cyber threats"],"dc:type":["text","Thesis"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Dissertation"],"thesis:degree_name":["Ph.D."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:24:48Z"}