2332-7790 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TBDATA.2017.2715335, IEEE
Transactions on Big Data
IEEE TRANSACTIONS ON BIG DATA 3
(e.g., Netflow, application logs, etc) and applies a MapRe-
duce model for feature extraction. Once organized into
clusters, the data is then used to determine attack presence
according to pre-defined rules.
Graph-based event correlation
While clustering determines attack presence through group-
ing common attack characteristics, it is limited in establish-
ing an accurate correlation which may exist between events.
This makes it difficult to accurately identify the sequences
of events leading to the presence of an attack within the
network, as well as the entry point of the attack.
Graph-based event correlation overcomes this limitation
by representing the events from the logs obtained as se-
quences in a graph. Given a collection of logs from different
points within the network (e.g., firewall logs, web server
logs, etc.), these events are correlated in a graph with the
event features (e.g., timestamp, source and destination IP,
etc.) represented as vertices and their correlations as edges.
This enables the accurate identification of the entry point
which an attack enters, as well as the sequences of events
which the attack undertakes.
Graphs-based event correlation is used in BotCloud, a
botnet detection system for large enterprise environments
[14]. Based on the Netflow data which describe the various
network traffic flows between clients, the scheme represents
the network flow between clients in the form of a depen-
dency graph. The graph is then input into a MapReduce
model to identify network IP associations using PageRank
algorithm.
Graphs-based event correlation is presented in the se-
curity framework designed to detect attacks within critical
infrastructures [15]. The scheme collects events from differ-
ent sources within the network, and generates a temporal
graph model to derive different event correlations for threat
detection.
Relationships between files are represented as a graph to
detect malware presence [16]. The scheme first collects from
the clients the file lists which describe their mutual rela-
tionships, and determines if there are potentially malicious
relationships. The file associations are then used to generate
an undirected weighted file relationship graph, and based
on the graph a belief propagation classifier is trained. On
the dataset from the Comodo Cloud Security Center, the
scheme achieved a detection accuracy of 95.81%.
2.3 Limitations of existing approaches
Existing approaches to detecting attack presence are limited
in terms of their ability to detect threats in real-time as well
as to scale across multiple hosts.
One of the limitations of existing security approaches
stems from the use of a dedicated signature database for
threat detection. This applies to approaches that feature a
regularly updated attack signature database for threat detec-
tion. Typically in the in-VM and outside-VM interworking
approach, an in-VM agent detects and passes any suspicious
file to the remote scrunity server, which uses the signature
database to determine if it is a malware. The dependence
on a regularly-updated signature database makes it limited
in detecting zero-day attacks. While BareCloud [17] and
CloudAV [4] attempt to get around this limitation by using
multiple antivirus engines for threat detection, they are still
limited in detecting previously undiscovered attacks due
to the post factum data in updating the signature database.
This is further exacerbated by an increased number of false
positives reported by the different antivirus engines.
Security analytics removes the need for signature
database by correlating events from the collected logs, but
they still suffer from the post factum data in training for
threat detection. Typically BotCloud [14] and Nazca [18]
collect data over long periods of time (usually over a 24
hour period) and apply analytics for threat detection. While
a long period of time allows for a rich collection of data, that
entails a tendency in detecting threats which have already
taken place over a breadth of time within the network. This
makes it difficult, if not impossible, to focus on immediate
events and take immediate actions against a compromised
point within the network.
Another limitation of existing security approaches is
the centralized execution process. For instance, SINBAPT
[13] runs on a single host, collecting data from various
points within the network and analysing them as a single
centralized process. While centralized execution process is
feasible in network environments in which there is a single
centralized server responsible for monitoring all network
components, it is infeasible for large network environments
in which multiple guest VMs are hosted on different hosts
and attack presence has to be communicated to other hosts
in near real-time.
3 PROPOSED APPROACH
3.1 Overall Framework
The basic idea of our proposed approach is to detect in real-
time any malware and rookit attacks via holistic efficient
use of all possible information obtained from the virtualized
infrastructure, e.g., various network and user application
logs. Our proposed approach is a big data problem for the
following characteristics of the network and user applica-
tion logs collected from a virtualized infrastructure:
• Volume: Depending on the number of guest VMs and
the size of the network, the amount of the network
and user application logs to be collected can range
from approximately 500 MB to 1 GB an hour;
• Velocity: The network and user application logs are
collected in real-time, in order to detect the pres-
ence of malware and rootkit attacks, accordingly the
collected data containing its behavior needs to be
processed as soon as possible;
• Veracity: Due to the “low and slow” approach that
malware and rootkit take in hiding their presence
within the guest VMs, data analysis has to rely upon
event correlation and advanced analytics.
The design principles, which are integral in the devel-
opment of our BDSA approach to protecting virtualized
infrastructures, can be elaborated as follows.
• Design Principle # 1 - Unsupervised classification:
The attack detection system should be able to classify
potential attack presence based on the data collected
from the virtualized infrastructure over time.
剩余14页未读，继续阅读
heiqiyu
- 粉丝: 0
- 资源: 4
我的内容管理
展开
最新资源
- 构建Cadence PSpice仿真模型库教程
- VMware 10.0安装指南：步骤详解与网络、文件共享解决方案
- 中国互联网20周年必读：影响行业的100本经典书籍
- SQL Server 2000 Analysis Services的经典MDX查询示例
- VC6.0 MFC操作Excel教程：亲测Win7下的应用与保存技巧
- 使用Python NetworkX处理网络图
- 科技驱动：计算机控制技术的革新与应用
- MF-1型机器人硬件与robobasic编程详解
- ADC性能指标解析：超越位数、SNR和谐波
- 通用示波器改造为逻辑分析仪：0-1字符显示与电路设计
- C++实现TCP控制台客户端
- SOA架构下ESB在卷烟厂的信息整合与决策支持
- 三维人脸识别：技术进展与应用解析
- 单张人脸图像的眼镜边框自动去除方法
- C语言绘制图形：余弦曲线与正弦函数示例
- Matlab 文件操作入门：fopen、fclose、fprintf、fscanf 等函数使用详解
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
