Graduate School and Research Center In communication systems

Addressing the attack attribution problem using knowledge discovery and multi-criteria fuzzy decision-making

Thonnard, Olivier;Mees, Wim;Dacier, Marc

KDD 2009, 15th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Workshop on CyberSecurity and Intelligence Informatics, June 28th-July 1st, 2009, Paris, France

In network traffic monitoring, and more particularly in the realm of threat intelligence, the problem of \attack attribution" refers to the process of effectively attributing new attack events to (un)-known phenomena, based on some evidence or traces left on one or several monitoring platforms. Real-world attack phenomena are often largely distributed on the Internet, or can sometimes evolve quite rapidly. This makes them inherently complex and thus difficult to analyze. In general, an analyst must consider many different attack features (or criteria) in order to decide about the plausible root cause of a given attack, or to attribute it to some given phenomenon. In this paper, we introduce a global analysis method to address this problem in a systematic way. Our approach is based on a novel combination of a knowledge discovery technique with a fuzzy inference system, which somehow mimics the reasoning of an expert by implementing a multi-criteria decision-making process built on top of the previously extracted knowledge. By applying this method on attack traces, we are able to identify largescale attack phenomena with a high degree of confidence. In most cases, the observed phenomena can be attributed to so-called zombie armies - or botnets, i.e. groups of compromised machines controlled remotely by a same entity. By means of experiments with real-world attack traces, we show how this method can effectively help us to perform a behavioral analysis of those zombie armies from a long-term, strategic viewpoint.

Document Doi Bibtex

Keywords:Intelligence monitoring and analysis, attack attribution
Type:Conference
Language:English
City:Paris
Country:FRANCE
Date:
Department:Networking and Security
Eurecom ref:2806
Copyright: © ACM, 2009. This is the author's version of the work. It is posted here by permission of ACM for your personal use. Not for redistribution. The definitive version was published in KDD 2009, 15th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Workshop on CyberSecurity and Intelligence Informatics, June 28th-July 1st, 2009, Paris, France http://dx.doi.org/10.1145/1599272.1599277
Bibtex: @inproceedings{EURECOM+2806, doi = {http://dx.doi.org/10.1145/1599272.1599277}, year = {2009}, title = {{A}ddressing the attack attribution problem using knowledge discovery and multi-criteria fuzzy decision-making}, author = {{T}honnard, {O}livier and {M}ees, {W}im and {D}acier, {M}arc}, booktitle = {{KDD} 2009, 15th {ACM} {SIGKDD} {C}onference on {K}nowledge {D}iscovery and {D}ata {M}ining, {W}orkshop on {C}yber{S}ecurity and {I}ntelligence {I}nformatics, {J}une 28th-{J}uly 1st, 2009, {P}aris, {F}rance}, address = {{P}aris, {FRANCE}}, month = {06}, url = {http://www.eurecom.fr/publication/2806} }