1Attack Pattern Discovery in Forensic Investigation of Network Attacks

Network attacks on systems perpetrated by remote hackers rarely occur in isolation; when a successful or merely detected attack occurs, it is often desirable to reconstruct the context of this security breach: all the events that lead up to and are related to the breach. We mine the logs of recent network traffic data to find these contexts of attacks — we call them attack patterns. We propose an iterative algorithm for discovering attack patterns; the logs are scanned to identify coherent groups of events (called bubbles) that are likely to constitute attacks, and via a feedback mechanism, the degrees of belief that the bubbles are attack instances are propagated to the next iteration in order to refine the search for bubbles related to the ones already found. Our simulations verify that the algorithm achieves accuracy in discovering attack patterns. Our attack pattern discovery has the additional advantage of being an unsupervised algorithm, e.g., it does not require a priori user-defined thresholds