An experiment using factor graph for early attack detection

This paper presents a factor graph based framework (named AttackTagger) for high accuracy and preemptive detection of attacks. We use security logs of real-incidents that occurred over a six-year period at the National Center for Supercomputing Applications (NCSA) at the University of Illinois to evaluate AttackTagger. Our data consist of attacks that led directly to the target system being compromised, i.e., not detected in advance, either by the security analysts or by intrusion detection systems. AttackTagger can detect 74 percent of attacks before the system misuse. AttackTagger uncovered six hidden attacks that were not detected by security analysts.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2015

Author dc:creator

• Cao, Phuong

Contributors dc:contributor

• Iyer, Ravishankar K.
• Iyer, Ravishankar K

• probabilistic graphical models
• factor graph
• security incidents
• preemptive intrusion detection

Statement dc:rights

• Copyright 2015 Phuong Cao

Handle dc:identifier

http://hdl.handle.net/2142/78579

OAI identifier oai:identifier

oai:www.ideals.illinois.edu:2142/78579