Cargando…

Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models

Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which freq...

Descripción completa

Detalles Bibliográficos
Autores principales: Zhang, Xu, Wu, Ting, Zheng, Qiuhua, Zhai, Liang, Hu, Haizhong, Yin, Weihao, Zeng, Yingpei, Cheng, Chuanhui
Formato: Online Artículo Texto
Lenguaje:English
Publicado: MDPI 2022
Materias:
Acceso en línea:https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9026394/
https://www.ncbi.nlm.nih.gov/pubmed/35458857
http://dx.doi.org/10.3390/s22082874
_version_ 1784691110719782912
author Zhang, Xu
Wu, Ting
Zheng, Qiuhua
Zhai, Liang
Hu, Haizhong
Yin, Weihao
Zeng, Yingpei
Cheng, Chuanhui
author_facet Zhang, Xu
Wu, Ting
Zheng, Qiuhua
Zhai, Liang
Hu, Haizhong
Yin, Weihao
Zeng, Yingpei
Cheng, Chuanhui
author_sort Zhang, Xu
collection PubMed
description Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which frequently results in the model training into a local optimum, thus, making the model unable to fit the alert logs well and thereby reducing the detection effectiveness of the model. To solve this issue, we propose a pre-training method for multi-step attack detection models based on the high semantic similarity of alerts in the same attack phase. The method first clusters the alerts based on their semantic information and pre-classifies the attack phase to which each alert belongs. Then, the distance of the alert vector to each attack stage is converted into the probability of generating alerts in each attack stage, replacing the initial value of Baum–Welch. The effectiveness of the proposed method is evaluated using the DARPA 2000 dataset, DEFCON21 CTF dataset, and ISCXIDS 2012 dataset. The experimental results show that the hidden Markov multi-step attack detection method based on pre-training of the proposed model parameters had higher detection accuracy than the Baum–Welch-based, K-means-based, and transfer learning differential evolution-based hidden Markov multi-step attack detection methods.
format Online
Article
Text
id pubmed-9026394
institution National Center for Biotechnology Information
language English
publishDate 2022
publisher MDPI
record_format MEDLINE/PubMed
spelling pubmed-90263942022-04-23 Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models Zhang, Xu Wu, Ting Zheng, Qiuhua Zhai, Liang Hu, Haizhong Yin, Weihao Zeng, Yingpei Cheng, Chuanhui Sensors (Basel) Article Currently, hidden Markov-based multi-step attack detection models are mainly trained using the unsupervised Baum–Welch algorithm. The Baum–Welch algorithm is sensitive to the initial values of model parameters. However, its training uses random or average parameter initialization methods, which frequently results in the model training into a local optimum, thus, making the model unable to fit the alert logs well and thereby reducing the detection effectiveness of the model. To solve this issue, we propose a pre-training method for multi-step attack detection models based on the high semantic similarity of alerts in the same attack phase. The method first clusters the alerts based on their semantic information and pre-classifies the attack phase to which each alert belongs. Then, the distance of the alert vector to each attack stage is converted into the probability of generating alerts in each attack stage, replacing the initial value of Baum–Welch. The effectiveness of the proposed method is evaluated using the DARPA 2000 dataset, DEFCON21 CTF dataset, and ISCXIDS 2012 dataset. The experimental results show that the hidden Markov multi-step attack detection method based on pre-training of the proposed model parameters had higher detection accuracy than the Baum–Welch-based, K-means-based, and transfer learning differential evolution-based hidden Markov multi-step attack detection methods. MDPI 2022-04-08 /pmc/articles/PMC9026394/ /pubmed/35458857 http://dx.doi.org/10.3390/s22082874 Text en © 2022 by the authors. https://creativecommons.org/licenses/by/4.0/Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
spellingShingle Article
Zhang, Xu
Wu, Ting
Zheng, Qiuhua
Zhai, Liang
Hu, Haizhong
Yin, Weihao
Zeng, Yingpei
Cheng, Chuanhui
Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title_full Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title_fullStr Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title_full_unstemmed Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title_short Multi-Step Attack Detection Based on Pre-Trained Hidden Markov Models
title_sort multi-step attack detection based on pre-trained hidden markov models
topic Article
url https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9026394/
https://www.ncbi.nlm.nih.gov/pubmed/35458857
http://dx.doi.org/10.3390/s22082874
work_keys_str_mv AT zhangxu multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT wuting multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT zhengqiuhua multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT zhailiang multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT huhaizhong multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT yinweihao multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT zengyingpei multistepattackdetectionbasedonpretrainedhiddenmarkovmodels
AT chengchuanhui multistepattackdetectionbasedonpretrainedhiddenmarkovmodels