Situation Awareness of multistage cyber attacks by semantic event fusion

Sunu Mathew; Shambhu Upadhyaya; Moises Sudit; Adam Stotz

doi:10.1109/MILCOM.2010.5680121

Situation Awareness of multistage cyber attacks by semantic event fusion

Sunu Mathew
, Shambhu Upadhyaya
, Moises Sudit
, Adam Stotz

SUNY Buffalo
CUBRC

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

13 Scopus citations

Abstract

In this paper, we present strategies for real-time Situation Awareness of multistage cyber-attacks by utilizing heterogeneous sensor event streams. A flexible and practically usable attack modeling approach based on network connectivity and attack progression semantics is used to produce multistage attack templates. Events in live alert streams are correlated based on their semantics and the attack templates to provide analysts with effective perception, comprehension and projection of likely attacks and their progression. The techniques form the basis of the Event Correlation for Cyber Attack Recognition System (ECCARS), which is tested and validated extensively with realistic datasets.

Original language	English
Title of host publication	2010 IEEE Military Communications Conference, MILCOM 2010
Pages	1286-1291
Number of pages	6
DOIs	https://doi.org/10.1109/MILCOM.2010.5680121
State	Published - 2010
Event	2010 IEEE Military Communications Conference, MILCOM 2010 - San Jose, CA, United States Duration: Oct 31 2010 → Nov 3 2010

Publication series

Name	Proceedings - IEEE Military Communications Conference MILCOM

Conference

Conference	2010 IEEE Military Communications Conference, MILCOM 2010
Country/Territory	United States
City	San Jose, CA
Period	10/31/10 → 11/3/10

Access to Document

10.1109/MILCOM.2010.5680121

Cite this

@inproceedings{6342a91729fe4727b57ae97bb717c787,

title = "Situation Awareness of multistage cyber attacks by semantic event fusion",

abstract = "In this paper, we present strategies for real-time Situation Awareness of multistage cyber-attacks by utilizing heterogeneous sensor event streams. A flexible and practically usable attack modeling approach based on network connectivity and attack progression semantics is used to produce multistage attack templates. Events in live alert streams are correlated based on their semantics and the attack templates to provide analysts with effective perception, comprehension and projection of likely attacks and their progression. The techniques form the basis of the Event Correlation for Cyber Attack Recognition System (ECCARS), which is tested and validated extensively with realistic datasets.",

author = "Sunu Mathew and Shambhu Upadhyaya and Moises Sudit and Adam Stotz",

year = "2010",

doi = "10.1109/MILCOM.2010.5680121",

language = "English",

isbn = "9781424481804",

series = "Proceedings - IEEE Military Communications Conference MILCOM",

pages = "1286--1291",

booktitle = "2010 IEEE Military Communications Conference, MILCOM 2010",

note = "2010 IEEE Military Communications Conference, MILCOM 2010 ; Conference date: 31-10-2010 Through 03-11-2010",

}

Mathew, S, Upadhyaya, S , Sudit, M & Stotz, A 2010, Situation Awareness of multistage cyber attacks by semantic event fusion. in 2010 IEEE Military Communications Conference, MILCOM 2010., 5680121, Proceedings - IEEE Military Communications Conference MILCOM, pp. 1286-1291, 2010 IEEE Military Communications Conference, MILCOM 2010, San Jose, CA, United States, 10/31/10. https://doi.org/10.1109/MILCOM.2010.5680121

Situation Awareness of multistage cyber attacks by semantic event fusion. / Mathew, Sunu; Upadhyaya, Shambhu ; Sudit, Moises et al.
2010 IEEE Military Communications Conference, MILCOM 2010. 2010. p. 1286-1291 5680121 (Proceedings - IEEE Military Communications Conference MILCOM).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Situation Awareness of multistage cyber attacks by semantic event fusion

AU - Mathew, Sunu

AU - Upadhyaya, Shambhu

AU - Sudit, Moises

AU - Stotz, Adam

PY - 2010

Y1 - 2010

N2 - In this paper, we present strategies for real-time Situation Awareness of multistage cyber-attacks by utilizing heterogeneous sensor event streams. A flexible and practically usable attack modeling approach based on network connectivity and attack progression semantics is used to produce multistage attack templates. Events in live alert streams are correlated based on their semantics and the attack templates to provide analysts with effective perception, comprehension and projection of likely attacks and their progression. The techniques form the basis of the Event Correlation for Cyber Attack Recognition System (ECCARS), which is tested and validated extensively with realistic datasets.

AB - In this paper, we present strategies for real-time Situation Awareness of multistage cyber-attacks by utilizing heterogeneous sensor event streams. A flexible and practically usable attack modeling approach based on network connectivity and attack progression semantics is used to produce multistage attack templates. Events in live alert streams are correlated based on their semantics and the attack templates to provide analysts with effective perception, comprehension and projection of likely attacks and their progression. The techniques form the basis of the Event Correlation for Cyber Attack Recognition System (ECCARS), which is tested and validated extensively with realistic datasets.

UR - https://www.scopus.com/pages/publications/79951657380

U2 - 10.1109/MILCOM.2010.5680121

DO - 10.1109/MILCOM.2010.5680121

M3 - Conference contribution

AN - SCOPUS:79951657380

SN - 9781424481804

T3 - Proceedings - IEEE Military Communications Conference MILCOM

SP - 1286

EP - 1291

BT - 2010 IEEE Military Communications Conference, MILCOM 2010

T2 - 2010 IEEE Military Communications Conference, MILCOM 2010

Y2 - 31 October 2010 through 3 November 2010

ER -

Situation Awareness of multistage cyber attacks by semantic event fusion

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this