Attack Logs Research Articles

Security Information Event Management data acquisition and analysis methods with machine learning principles

In the face of increasing global disruptions, the cybersecurity field is confronting rising threats posed by offensive groups and individual hackers. Traditional security measures often fall short in detecting and mitigating these sophisticated attacks, necessitating advanced intrusion detection methods. The goal of our study is to develop robust network intrusion detection methods using machine learning techniques. In addition, we evaluate the effectiveness of various machine learning models in detecting network intrusions. Model performances are optimized through hyperparameter tuning and feature selection. A range of classification and clustering models have been employed. Data from SIEM systems capturing real-time statistics from cloud-hosted Windows virtual machines has been gathered and augmented with web attack logs from CICIDS2017, each comprising approximately fifteen thousand rows. Hyperparameter tuning, data normalization, standardization and feature selection techniques for model optimization have been used in our study. The research showcases the potential of machine learning in enhancing network intrusion detection capabilities. The findings underscore the effectiveness of the Random Forest Classifier (0.97) and highlight the importance of utilizing diverse datasets and advanced optimization techniques. This study offers valuable insights and sets a foundation for future advancements in cybersecurity strategies and intrusion detection systems.

LogPrécis: Unleashing language models for automated malicious log analysis: Précis: A concise summary of essential points, statements, or facts

Security logs are the key to understanding attacks and diagnosing vulnerabilities. Often coming in the form of text logs, their analysis remains a daunting challenge. Language Models (LMs) have demonstrated unmatched potential in understanding natural and programming languages. The question arises as to whether and how LMs could be also used to automatise the analysis of security logs. We here systematically study how to benefit from the state-of-the-art LM to support the analysis of text-like Unix shell attack logs automatically. For this, we thoroughly designed LogPrécis. LogPrécis receives as input malicious shell sessions. It then automatically identifies and assigns the attacker tactic to each portion of the session, i.e., unveiling the sequence of the attacker's goals. This creates a unique attack fingerprint. We demonstrate LogPrécis capability to support the analysis of two large datasets containing about 400,000 unique Unix shell attacks recorded in a 2-year-long honeypot deployment. LogPrécis reduces the analysis to about 3,000 unique fingerprints. Such abstraction lets us better understand attacks, extract attack prototypes, detect novelties, and track families and mutations. Overall, LogPrécis, released as open source, demonstrates the potential of adopting LMs for security analysis and paves the way for better and more responsive defence against cyberattacks.

A Hybrid Model for Detecting Phishing Attack Using Recommedation Decision Trees

Phishing performs by trying to trick the victim into accessing any computing information which looks original, then instructing them to send important data to unrestricted/unwanted privacy resource. For prevention, it is essential to develop a phishing detection system. Recent phishing detection systems are based on data mining and machine learning techniques. Most of the related work literature require collection of previous phishing attack logs, analyze them and create a list of such activities and block traffic from such sources. But this is a cumbersome task because the data size is very large, continue changing and dynamic nature. [1]. Instead of using single algorithm approach it would be better to use a hybrid approach. A hybrid approach would be better at mitigating phishing attacks because classification of different format of data is handled; whether the intruder want to use images or textural input to gain into another user system for phishing. Hybrid recommendation decision tress enhances any of machine learning and deep learning algorithms performance. The decision path of the model followed a series of if/else/then statements that connect the predicted class from the root of the tree through the branches of the tree to detect true positive and false negatives of phishing attempts. 10 decision trees were considered and used the features to train the recommendation decision regression model. The developed hybrid recommendation decision tree approach provided an overall true positive rate of the model of 92.28 % and false negative rate is 7.4%.

An Effective Threat Detection Framework for Advanced Persistent Cyberattacks

Recently, with the normalization of non-face-to-face online environments in response to the COVID-19 pandemic, the possibility of cyberattacks through endpoints has increased. Numerous endpoint devices are managed meticulously to prevent cyberattacks and ensure timely responses to potential security threats. In particular, because telecommuting, telemedicine, and tele-education are implemented in uncontrolled environments, attackers typically target vulnerable endpoints to acquire administrator rights or steal authentication information, and reports of endpoint attacks have been increasing considerably. Advanced persistent threats (APTs) using various novel variant malicious codes are a form of a sophisticated attack. However, conventional commercial antivirus and anti-malware systems that use signature-based attack detection methods cannot satisfactorily respond to such attacks. In this paper, we propose a method that expands the detection coverage in APT attack environments. In this model, an open-source threat detector and log collector are used synergistically to improve threat detection performance. Extending the scope of attack log collection through interworking between highly accessible open-source tools can efficiently increase the detection coverage of tactics and techniques used to deal with APT attacks, as defined by MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK). We implemented an attack environment using an APT attack scenario emulator called Carbanak and analyzed the detection coverage of Google Rapid Response (GRR), an open-source threat detection tool, and Graylog, an open-source log collector. The proposed method expanded the detection coverage against MITRE ATT&CK by approximately 11% compared with that conventional methods.

Evaluation of Naive Bayes, Random Forest and Stochastic Gradient Boosting Algorithm on DDoS Attack Detection

The Internet has given unlimited access to every user through the network used. Vulnerabilities in a network can also be caused by increasing knowledge about hacking and cracking. This is the reason why information and network security are so important. The dataset used in this study uses a dataset from CIC (Canadian Institute Cybersecurity), which covers 7 different attack scenarios, including brute-force, heartbleed, botnet, dos, DDoS, web attacks, and network infiltration from within. The existing attack documents will be extracted. Feature extraction is a process to find the feature values contained in documents for the text mining process. Based on this explanation, this DDoS attack will generate a log where the attack log will be processed and processed into a CSV file for the classification process using Naive Bayes, Random Forest, and Stochastic Gradient Boosting. In this study, researchers used the Naive Bayes, Random Forest, and Stochastic Gradient Boosting algorithms to generate a classification comparison of DDoS attack data so that researchers can find out which algorithm is the best in generating classifications for DDoS attack cases. The results of this study can be concluded that the average accuracy generated by Naive Bayes is 82.45%, the average accuracy generated by the Random Forest algorithm is 99.78%, and the average accuracy generated by the Stochastic Gradient Boosting algorithm is 100%, so that the SGB algorithm is better than Naive Bayes and Random Forest algorithms in classifying DDoS attacks.

Implementasi Honeypot Menggunakan Dionaea Dan Kippo Sebagai Penunjang Keamanan Jaringan Komunikasi Komputer

Today, the internet has become the most used tool for delivering information. Through the internet, people can search for information by freely accessing a web page. This freedom of access often raises security issues in the website provider's internal network. These security issues can be in the form of misuse of information, threats, and other attacks on the provider's internal network. Based on these conditions, a technique is needed to protect important data on the website owner's server from various attacks. In this research, a Honeypot security system has been implemented using Dionaea and Kippo in the Demilitarized Zone to increase the security of a network. The methodology of this research is Waterfall Model for software engineering. The system that has been built is able to detect, take action, record attack logs and display them in the form of a website in real time.

Intrusion Detection Based on Sequential Information Preserving Log Embedding Methods and Anomaly Detection Algorithms

Previous methods for system intrusion detection have mainly consisted of those based on pattern matching that employs prior knowledge extracted from experts’ domain knowledge. However, pattern matching-based methods have a major drawback that it can be bypassed through various modified techniques. These advanced persistent threats cause limitation to the pattern matching-based detecting mechanism, because they are not only more sophisticated than usual threats but also specialized in the targeted attacking object. The defense mechanism should have to comprehend unusual phenomenons or behaviors to successfully handles the advanced threats. To achieve this, various security techniques based on machine learning have been developed recently. Among these, anomaly detection algorithms, which are trained in unsupervised fashion, are capable of reducing efforts of security experts and securing labeled dataset through post analysis. It is further possible to distinguish abnormal behaviors more precisely by training classification models if sufficient amounts of labeled dataset is obtained through post analysis of anomaly detection results. In this study, we proposed an end-to-end abnormal behavior detection method based on sequential information preserving log embedding algorithms and machine learning-based anomaly detection algorithms. Contrary to other machine learning based system anomaly detection models, which borrow domain experts’ knowledge to extract significant features from the log data, raw log data are transformed into a fixed size of continuous vector regardless of their length, and these vectors are used to train the anomaly detection models. Experimental results based on a real system call trace dataset, our proposed log embedding method with unsupervised anomaly detection model yielded a favorable performance, at most 0.8708 in terms of AUROC, and it can be further improved up to 0.9745 with supervised classification algorithms if sufficient labeled attack log data become available.

Analysis of Digital Evidence on Denial of Service (DoS) Attack Log Based

This research is carried out an analysis and investigation of digital log file data retrieval from DoS (Denial of Service) attacks, on internet networks that have been detected by IDS (Intrusion Detection System) and using Wireshark as Tools Analysis Network. The research phase begins with the design of an experimental scenario which is often carried out daily where users access the internet network. The next stage is an attack in the form of ping flood on the target computer connected to the internet network, the final stage of data retrieval which will be analyzed later. Testing research using UAT (User Acceptance Test), to prove that the analysis has been received by the user. The results of research conducted to obtain data in the form of an attacker's IP (Internet Protocol), target IP, protocol type, the port used and the time of the attack. In the UAT test results, the obtained value of 18% of students disagrees, 58% of students agree, and 24% of students strongly agree. This research has conducted an analysis of random data attacks using Wireshark applications received by users.

PERANCANGAN SISTEM PENDETKSI SERANGAN PADA SERVER JARINGAN KOMPUTER MENGGUNAKAN SNORT BERBASIS SMS GETEWAY

Server on a network becomes an important point because its function is to serve all requests required by all clients on a network. For that, maintaining the security of a server is also very important because if the server is experiencing a problem then there is no one the network can serve the request from the client. This makes a server administrator must see traffic to the server at any time. For this reason, it is important to conduct an attack detection system research in order to help the performance of administrators. Detection of attacks directed to the server is an early solution in securing a server from attack. For attack detection systems, SNORT is generally able to detect almost any attack because it has many rules that can be modified. Detection system by configuring and adding the rule first on the server. If there is an incoming attack then SNORT will compare the attack with the existing rule, SNORT will later categorize the attack into 3 types of High, Medium and Low. The design of attack detection system using SNORT and web server is planted on Raspberry Pi. Web server that is planted on Raspberry Pi as information system or container of attack records. In addition, Raspberry Pi also implemented database to store attack log which will be sent via sms gateway. The overall test results of the system built on this final project work well. The admin user can login the web server and do the user creation properly. Among the 6 rule attacks that have been implemented, all rules can read the attack accurately and able to save it into the database. From 75 attacks recorded in the database, only 80% attack detection can be displayed in the web server. And the web server is capable of sending 77.3% of attack notifications to the admin.

Distributed Detection and prevention of Web Threats in Heterogeneous Environment

The growth of web Applications have increased rapidly due to the huge development of technology with very short turnaround time and with this development the protection from vulnerabilities became very difficult. There is a continuous demand for developing new methods that is able to prevent the fast growth of attacking methods and vulnerabilities. Furthermore there is a great demand to have coordination between different security infrastructure and protection applications to distribution of the attack log in order to prevent the attacker from further attacks to other web hosts. This research proposes a distributed web firewall defensive mechanism which provide a synchronized environment that is consists of several synchronized web application firewalls. Every web application is protected by a web application firewall that send feedback reports that include the type of the attack, The IP Address of the attacker and time of attack to other synchronized firewalls inside the environment to take action against the attacker.

Dynamic game model of botnet DDoS attack and defense

Botnet has become a popular technique for deploying Internet crimes. The command of botnet has evolved into a major way for attackers to launch Distributed Denial of Service attacks on network servers. Modelized analysis methods need to be studied for botnet attacks implements, defense, and prediction. In this paper, we propose a novel game theory-based model to describe the scenario, in which the botmaster launching Distributed Denial of Service attacks using a botnet while the defender equipped a firewall defending. In our model, we consider the following: firstly, the botmaster and the defender can be rational or irrational; secondly, the interaction between the botmaster and the defender is modeled as a dynamic game; thirdly, their supporting or not self-learning databases. We detail the analysis of eight sub-scenarios for the assumptions and give an easy-to-use algorithm for adjustment of offensive and defensive strategy. We use the OPNET to validate our model and its effectiveness. The experiment result shows that our strategy can improve the firewall abilities to lower false alarm rate FR and improve the botmaster lower exposure rate of botnet to avoid detection. Furthermore, the model is helpful to evaluate defense ability of the defender towards current botmaster attacks by analyzing attack log in sandbox. Copyright © 2016 John Wiley & Sons, Ltd.

Machine Learning based Traffic Classification using Low Level Features and Statistical Analysis

In this paper, Data mining technique is used to present the concept of attack data analysis and traffic classification. Here the system is completely a automated system that contains packet capturing, processing of multiple attack logs, labeling of network traffic based on low level features and applying the classification algorithm to build a traffic classifier which will classify the normal and malicious traffic. In this paper mixing of machine learning approach and behavior based analysis is done to valid the analysis results in a better way. Previously lot‟s of work has been done in this field to classify the network logs but all of the existing techniques such as payload based, port based classifications have their own advantages and disadvantages but classification using Machine Learning techniques is still an open field to explore and has provided an excellent results up till now. The main aim of the proposed work is to perform the passive traffic monitoring based on honeypot technology and then analyze the network attack logs to determine the intruders. We collect attack data throw honeypot system and normal user browser than we combined that attack data and develop an automated traffic classification system based on the low level features of the network traffic. This type of classification will help the IT administrators to determine the unknown attacks spreading in the IT industry.

NETWORK INTRUSION DETECTION AND PREVENTION ATTACKS

Intrusion detection is an important technology in business sector as well as an active area of research. It is an important tool for information security. A Network Intrusion Detection System is used to monitor networks for attacks or intrusions and report these intrusions to the administrator in order to take evasive action. Today computers are part of networked; distributed systems that may span multiple buildings sometimes located thousands of miles apart. The network of such a system is a pathway for communication between the computers in the distributed system. The network is also a pathway for intrusion. This system is designed to detect and combat some common attacks on network systems. It follows the signature based IDs methodology for ascertaining attacks. A signature based IDS will monitor packets on the network and compare them against a database of signatures or attributes from known malicious threats. In this system the attack log displays the list of attacks to the administrator for evasive action. This system works as an alert device in the event of attacks directed towards an entire network.

Blacklisting Recommendation System: Using Spatio-Temporal Patterns to Predict Future Attacks

In this paper, we study the problem of forecasting attack sources based on past attack logs from several contributors. We formulate this problem as an implicit recommendation system, and we propose a multi-level prediction model to solve it. Our model evaluates and combines various factors, namely: (i) attacker-victim history using time-series, (ii) attackers and/or victims interactions using neighborhood models and (iii) global patterns using singular value decomposition. We evaluate our combined method, referred to as Blacklisting Recommendation System (or BRS), on one month of logs from Dshield, and we demonstrate that it improves significantly the prediction rate over state-of-the-art methods as well as the robustness against poisoning attacks. Along the way, we analyze the Dshield dataset, and we reveal dominant patterns of malicious traffic.

Fast WEP-Key Recovery Attack Using Only Encrypted IP Packets

Conventional efficient key recovery attacks against Wired Equivalent Privacy (WEP) require specific initialization vectors or specific packets. Since it takes much time to collect the packets sufficiently, any active attack should be performed. An Intrusion Detection System (IDS), however, will be able to prevent the attack. Since the attack logs are stored at the servers, it is possible to prevent such an attack. This paper proposes an algorithm for recovering a 104-bit WEP key from any IP packets in a realistic environment. This attack needs about 36, 500 packets with a success probability 0.5, and the complexity of our attack is equivalent to about 220 computations of the RC4 key setups. Since our attack is passive, it is difficult for both WEP users and administrators to detect our attack.

Role of Tree Diameter in the Damage Caused by the Sugi Bark Borer (Coleoptera: Cerambycidae) to the Japanese Cedar, Cryptomeria japonica

To understand the damage of the sugi bark borer, Semanotus japonicus Lacordaire, to larger Japanese cedars, Cryptomeria japonica D. Don., we inoculated living cedar trees of different sizes with hatched larvae. We also studied the oviposition preference of adult borers to logs of different sizes. Almost all larvae inoculated into larger trees were killed by resin flow between the outer and inner bark; however, in smaller trees, about half of the larvae survived. In the oviposition preference test, female adults tended to attack logs with larger diameters. This suggests that despite the high mortality of the young larvae in the larger cedar trees, adults prefer large diameter trees because the rougher trunk surface presents more suitable hiding and oviposition sites. Bark roughness was considered to determine the occurrence of damage from the sugi bark borer.

Competitive interactions between the mountain pine beetle and the pine engraver in lodgepole pine

The pine engraver (PE), Ipspini (Say), often coexists with the mountain pine beetle (MPB), Dendroctonusponderosae Hopk., in lodgepole pine, Pinuscontorta var. latifolia Engelm. The PE colonizes the upper bole, while the MPB infests the lower bole. We investigated the hypothesis that interspecific interactions between the PE and the MPB within trees can adversely affect MPB progeny production or survival. In lodgepole pine bark attacked by both species, PE and MPB emergence holes had a strong negative interrelationship, suggesting that high numbers of one species resulted in lower numbers of the other. In the laboratory, attacks by PEs on lodgepole pine logs resulted in significantly decreased numbers of MPB progeny, particularly when MPBs and PEs were allowed to attack logs simultaneously. Reductions in MPB progeny were 92.8 and 96.2% when the ratios of attacking beetles were 100 PE: 50 MPB per square metre and 200 PE: 50 MPB per square metre, respectively, compared with that in control logs with 50 MPB per square metre. In an August field experiment, pheromone-induced attack by the PE on trees just attacked by the MPB resulted in a 72.5% reduction in mean MPB progeny production compared with that in MPB-attacked control trees. Possible reasons for the reduced success of MPB when it and the PE coinhabit the same host may be exploitation competition, interference competition, or introduction of fungal competitors deleterious to the MPB. Induced infestation by PEs of MPB-infested trees may have the potential to reduce or control MPB populations.

ADVERSE EFFECT OF FENOXYCARB ON REPRODUCTION BY THE CALIFORNIA FIVESPINED IPS,IPS PARACONFUSUSLANIER (COLEOPTERA: SCOLYTIDAE)

AbstractThe effects of fenoxycarb, ethyl[2-(p-phenoxyphenoxy)-ethyl]carbamate, an insect growth regulator with juvenile hormone activity, on reproduction inIps paraconfususLanier were investigated. Topical treatment of either females or both sexes of parent beetles with 50 μg of fenoxycarb per insect resulted in a significant reduction in hatching of eggs and numbers of progeny produced by beetles allowed to infest logs of ponderosa pine,Pinus ponderosaLaws. When pairs of beetles were allowed to attack logs that were surface-treated with fenoxycarb, the effects on reproduction at a dose of 100 μg/cm2of bark surface were comparable to those of a topical treatment at a dose of 50 μg per insect. However, at doses of 1000 or 10 000 μg/cm2the adverse effects included reductions in the length of egg galleries, fecundity (number of egg niches), and number of freshly laid eggs. Percentage reductions in progeny were 35.8, 82.5, and 95.7 for doses of 100, 1000, and 10 000 μg/cm2, respectively, if brood beetles were allowed to emerge from the logs. This study indicates that fenoxycarb acts as an effective chemosterilant onI.paraconfusus.

Flight muscle volume change in Ips confusus (Coleoptera: Scolytidae)

Three pairs of dorsal–ventral flight muscles were excised from Ips confusus adults and measured, and their volumes calculated. There was a progressive development of muscle tissue from callow to emerged brood adults followed by a rapid degeneration (often over 90% of the original volume) after the insects entered fresh host logs. Solitary individuals of each sex forced to attack logs underwent muscle degeneration within 3 to 4 days. However, greater degeneration occurred when both sexes were in the same gallery and allowed to mate. Before reemergence, the flight muscles or males gradually increased in size whereas those of females remained degenerate much longer before rapidly regenerating. This condition was correlated with the longer reproductive period in females. The muscle volumes in reemerged adults of both sexes were larger than those of any other stage, possibly implying selection of superior insects.

Laboratory Studies on the Behaviour of the Douglas-fir Beetle,Dendroctonus pseudotsugaeHopkins

AbstractThe behaviour ofDendroctonus pseudotsugaeHopk. in different physiological states was studied in relation to temperature, light, and host.Newly emerged beetles preferred temperatures near the threshold for flight. When conditioned in dry air at room temperature for 16 hours they preferred cooler temperatures.At room temperature, most newly emerged beetles settled in the brightest zone of a light gradient (55 foot-candles), although some settled in dimmer zones. If the beetles' emergence was delayed or if they were stored after emergence, more remained in the zone between 0.5 and 10 foot-candles.In light-dark tests at room temperature most newly emerged beetles were photopositive, but some were indifferent and a few were photonegative. Increasing the temperature and humidity increased the proportion of photonegative individuals. Newly emerged females oriented more directly to a single source of light than males, bur after conditioning or aging both reacted similarly.Females were separated into three behavioural types based on their reactions. Photopositive individuals flew more readily than indifferent or photonegative beetles; some photonegative females showed no inclination to fly.Photopositive females were usually host negative but photonegative females were host positive. The proportion of these behavioural types within different samples varied. A group that emerged early contained a higher incidence of photopositive host-negative individuals than a group that emerged late, or was stored for 10 days after emergence. But host-negative beetles would attack logs after starvation, flight exercise, or exposure to more attractive hosts.Host-positive females contained less fat than host-negative siblings. The decline in lipids during aging, starvation or flight thus may induce behavioural changes.There is a co-ordination of successive activities in the Douglas-fir beetle similar to that reported for aphids. The initial urge to disperse outweighs responses to host stimuli, but this balance changes as the beetles fly or as host stimuli increase. The balance between thresholds for dispersal and attack also varies in relation to the conditions under which the emerging beetles developed. Consequently, each individual behaves differently when it emerges. The behaviour of a population changes as the season progresses and from year to year owing to changes in the state of individuals and in the attractiveness of hosts.