Cargando…
Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which freq...
Autores principales: | , , , , , , , |
---|---|
Formato: | Online Artículo Texto |
Lenguaje: | English |
Publicado: |
MDPI
2022
|
Materias: | |
Acceso en línea: | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9026394/ https://www.ncbi.nlm.nih.gov/pubmed/35458857 http://dx.doi.org/10.3390/s22082874 |
_version_ | 1784691110719782912 |
---|---|
author | Zhang, Xu Wu, Ting Zheng, Qiuhua Zhai, Liang Hu, Haizhong Yin, Weihao Zeng, Yingpei Cheng, Chuanhui |
author_facet | Zhang, Xu Wu, Ting Zheng, Qiuhua Zhai, Liang Hu, Haizhong Yin, Weihao Zeng, Yingpei Cheng, Chuanhui |
author_sort | Zhang, Xu |
collection | PubMed |
description | Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which frequently results in the model training into a local optimum, thus, making the model unable to fit the alert logs well and thereby reducing the detection effectiveness of the model. To solve this issue, we propose a pre-training method for multi-step attack detection models based on the high semantic similarity of alerts in the same attack phase. The method first clusters the alerts based on their semantic information and pre-classifies the attack phase to which each alert belongs. Then, the distance of the alert vector to each attack stage is converted into the probability of generating alerts in each attack stage, replacing the initial value of Baum–Welch. The effectiveness of the proposed method is evaluated using the DARPA 2000 dataset, DEFCON21 CTF dataset, and ISCXIDS 2012 dataset. The experimental results show that the hidden Markov multi-step attack detection method based on pre-training of the proposed model parameters had higher detection accuracy than the Baum–Welch-based, K-means-based, and transfer learning differential evolution-based hidden Markov multi-step attack detection methods. |
format | Online Article Text |
id | pubmed-9026394 |
institution | National Center for Biotechnology Information |
language | English |
publishDate | 2022 |
publisher | MDPI |
record_format | MEDLINE/PubMed |
spelling | pubmed-90263942022-04-23 Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models Zhang, Xu Wu, Ting Zheng, Qiuhua Zhai, Liang Hu, Haizhong Yin, Weihao Zeng, Yingpei Cheng, Chuanhui Sensors (Basel) Article Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which frequently results in the model training into a local optimum, thus, making the model unable to fit the alert logs well and thereby reducing the detection effectiveness of the model. To solve this issue, we propose a pre-training method for multi-step attack detection models based on the high semantic similarity of alerts in the same attack phase. The method first clusters the alerts based on their semantic information and pre-classifies the attack phase to which each alert belongs. Then, the distance of the alert vector to each attack stage is converted into the probability of generating alerts in each attack stage, replacing the initial value of Baum–Welch. The effectiveness of the proposed method is evaluated using the DARPA 2000 dataset, DEFCON21 CTF dataset, and ISCXIDS 2012 dataset. The experimental results show that the hidden Markov multi-step attack detection method based on pre-training of the proposed model parameters had higher detection accuracy than the Baum–Welch-based, K-means-based, and transfer learning differential evolution-based hidden Markov multi-step attack detection methods. MDPI 2022-04-08 /pmc/articles/PMC9026394/ /pubmed/35458857 http://dx.doi.org/10.3390/s22082874 Text en © 2022 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/). |
spellingShingle | Article Zhang, Xu Wu, Ting Zheng, Qiuhua Zhai, Liang Hu, Haizhong Yin, Weihao Zeng, Yingpei Cheng, Chuanhui Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title | Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title_full | Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title_fullStr | Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title_full_unstemmed | Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title_short | Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models |
title_sort | multi-step attack detection based on pre-trained hidden markov models |
topic | Article |
url | https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9026394/ https://www.ncbi.nlm.nih.gov/pubmed/35458857 http://dx.doi.org/10.3390/s22082874 |
work_keys_str_mv | AT zhangxu multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT wuting multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT zhengqiuhua multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT zhailiang multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT huhaizhong multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT yinweihao multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT zengyingpei multistepattackdetectionbasedonpretrainedhiddenmarkovmodels AT chengchuanhui multistepattackdetectionbasedonpretrainedhiddenmarkovmodels |