Error analysis of sequence modeling for projecting cyber attacks

Show simple item record

dc.contributor.advisor Kudithipudi, Dhireesha
dc.contributor.advisor Ganguly, Amlan
dc.contributor.author Mudireddy, Venkata
dc.date.accessioned 2012-08-15T16:52:35Z
dc.date.available 2012-08-15T16:52:35Z
dc.date.issued 2012-05
dc.identifier.uri http://hdl.handle.net/1850/15266
dc.description.abstract Intrusion Detection System (IDS) has become an integral component in the field of network security. Prior research has focused on developing efficient IDSs and correlating attacks as Attack Tracks. To enhance the network analyst's situational awareness, sequence modeling techniques like Variable Length Markov Models (VLMM) have been used to project likely future attacks. However, such projections are made assuming that the IDSs detect each and every attack action, which is not viable in reality. An IDS could miss an attack due to loss of packets or improper traffic analysis, or when an attacker evades detection by employing obfuscation techniques. Such missed detections, could negatively affect the prediction model, resulting in erroneous estimations. This thesis investigates the prediction performance as an error analysis of VLMM when used for projecting cyber attacks. This analysis is based on the impact of missed alerts, representing undetected attack actions. The analysis begins with an analytical study of a state-based Markov model, called Causal-State Splitting Reconstruction (CSSR), to contrast the context-based VLMM. Simulation results show that VLMM and CSSR perform comparably, with VLMM being a simpler model without the need to maintain and train the state space. A thorough design of experiments studies the effects of missing IDS alerts, by having missed alerts at different locations of the attack sequence with different rates. The experimental results suggested that the change in prediction accuracy is low when there are missed alerts in one part of the sequence and higher if they are throughout the entire sequence. Also, the prediction accuracy increases when there are rare alerts missing, and it decreases when there are common alerts missing. In addition, change in the prediction accuracy is relatively less for sequences with smaller symbol space compared to sequences with larger symbol space. Overall, the results demonstrate the robustness and limitations of VLMM when used for cyber attack prediction. The insights derived in this analysis will be beneficial to the security analyst in assessing the model in terms of its predictive performance when there are missed alerts. en_US
dc.language.iso en_US en_US
dc.subject None provided en_US
dc.subject.lcc TK5105.59 .M84 2012
dc.subject.lcsh Computer networks--Security measures en_US
dc.subject.lcsh Computer security--Mathematical models en_US
dc.subject.lcsh Computer crimes--Prevention en_US
dc.subject.lcsh Markov processes en_US
dc.title Error analysis of sequence modeling for projecting cyber attacks en_US
dc.type Thesis en_US
dc.description.college Kate Gleason College of Engineering en_US
dc.description.department Department of Computer Engineering en_US
dc.contributor.advisorChair Yang, Shanchieh

Files in this item

Files Size Format View
VMudireddyThesis5-2012.pdf 2.135Mb PDF View/Open

This item appears in the following Collection(s)

Show simple item record

Search RIT DML


Advanced Search

Browse