• Corpus ID: 231547341

A Novel AI-based Methodology for Identifying Cyber Attacks in Honey Pots

@inproceedings{AbuOdeh2021ANA,
  title={A Novel AI-based Methodology for Identifying Cyber Attacks in Honey Pots},
  author={Muhammed AbuOdeh and Christian Adkins and Omid Setayeshfar and Prashant Doshi and Kyu Hyung Lee},
  booktitle={AAAI},
  year={2021}
}

• Muhammed AbuOdeh, Christian Adkins, +2 authors K. H. Lee
• Published in AAAI 2021
• Computer Science

We present a novel AI-based methodology that identifies phases of a host-level cyber attack simply from system call logs. System calls emanating from cyber attacks on hosts such as honey pots are often recorded in audit logs. Our methodology first involves efficiently loading, caching, processing, and querying system events contained in audit logs in support of computer forensics. Output of queries remains at the system call level and is difficult to process. The next step is to infer a sequence of abstracted actions, which we colloquially call a storyline , from the system calls given as observations to a latent-state probabilistic model. These storylines are then accurately identified with class labels using a learned classifier. We qualitatively and quantitatively evaluate methods and models for each step of the methodology using 114 different attack phases collected by logging the attacks of a red team on a server, on some likely benign sequences containing regular user activities, and on traces from a recent DARPA project. The resulting end-to-end system, which we call Cyberian , identifies the attack phases with a high level of accu- racy illustrating the benefit that this machine learning-based methodology brings to security forensics. tool. Templated queries help identify possible attack phases and HMM based inference on these traces generates a comprehensible ‘storyline’, which facilitates identification of the attack phase using an LSTM classifier.