A multistage cyber-attack simulator to generate a new dataset

Document Type : Original Article

Authors

Head of Electrical and Computer Engineering Department in Malek Ashtar University

Abstract

In the field of cyber defense, researchers always suffer from the lack of a proper dataset to evaluate their proposed theories and methods. Unfortunately, in the various datasets existing in cyber defense scope, the ground truth is ambiguous, and the scenarios used by the attackers to carry out the attacks are unclear. This will lead to a serious challenge to the verification of methods and researches in this area. In this paper, a method is proposed by which a new database can be generated with the explisit ground truth and predetermined scenarios for multistage cyber attacks. In this method, a cyber attack guidance template is used to determine the various stages of the attacks and an attack scenario generator is also used to determine the scenarios used by simulated attackers. Network topology is considered as input, and random variables are used to create variety in simulator performances. Also, in the proposed method, various techniques such as fuzzy c-means for clustering, and artificial neural networks for classification are used. To set the simulator parameters, the CDX dataset is used and its ability to create a new dataset of multistage cyber attacks is well illustrated. To evaluate the proposed method, scoring by SME's is used, and finally with the mean score of 90.7, it had been approved.

Keywords

Main Subjects

References

[1]     Cohen, F. "Simulating Cyber Attacks, Defences, And Consequences"; J. Com. Sec. 1999, 18, 479-518.##
[2]     Park, J. S.; Lee, J.S.; Kim, H. K.; Jeong, J. R.; Yeom, D. B.; Chi, S. D. "Secusim: A Tool For The Cyber-Attack Simulation"; Proc. Int. Conf. Inf. Comm. Sec. 2001, 471-475.##
[3]     Kotenko I.; Mankov E. "Experiments With Simulation Of Attacks Against Computer Networks"; Proc. Int. Conf. Math. Meth. Mod. Arch. Com. Net. Sec. 2003, 183-194.##
[4]     Kuhl, M. E.; Kistner, J.; Costantini, K.; Sudit, M. "Cyber Attack Modeling And Simulation For Network Security Analysis"; Proc. Conf. Wint. Sim.2007, 1180-1188.##
[5]     Gonsalves, P. G.; Dougherty, E. T. "Adaptive Cyber-Attack Modeling System" Sens. & C3I Tech. for Hom. Sec. & Def.2006, 62-104.##
[6]     Cheung, S.; Lindqvist, U.; Fong, M. W.; "Modeling Multistep Cyber Attacks For Scenario Recognition"; Proc. DARPA Inf. Surv. Conf., 2003, 284-292.##
[7]     Sudit, M.; Stotz, A.; Holender, M.; "Situational Awareness Of A Coordinated Cyber Attack"; Data Min. Intr. Det. Inf. Assur. & Data Net. Sec.2005, 114-129.##
[8]     Costantini, K.; "Development Of A Cyber Attack Simulator For Network Modeling And Cyber Security Analysis"; Msc. Thesis, RIT university, Rochester, 2007.##
[9]     Brown, B.; Cutts, A.; McGrath, D.; Nicol, D. M.; Smith, T. P.; Tofel, B.; "Simulation Of Cyber Attacks With Applications In Homeland Defense Training"; Sens. & C3I Tech. for Hom. Sec. & Def., 2003, 63-71.##
[10]  Jajodia, S.; and Noel, S.; "Advanced Cyber Attack Modeling Analysis And Visualization"; George. Mason. Univ. Fairfax. Va., 2010.##
[11]  Qin, X.; Lee, W.; "Attack Plan Recognition And Prediction Using Causal Networks"; Proc.Comp. Sec. App. Conf., 2004, 370-379.##
[12]  Xie, P.; Li, J. H.; Ou, X.; Liu, P.; Levy, R.; "Using Bayesian Networks For Cyber Security Analysis"; Inter. Conf. Dep. Sys. & Net. (DSN), 2010, 211-220.##
[13]  Stotz, A.; Sudit, M.; "Information Fusion Engine For Real-Time Decision-Making (INFERD): A Perceptual System For Cyber Attack Tracking"; Inter. Conf. Inf. Fus., 2007, 1-8.##
[14]  Fava, D. S.; Byers, S. R.; Yang, S. J.; "Projecting Cyberattacks Through Variable-Length Markov Models"; J. IEEE. Trans. Inf. Forens. & Sec., 2008, 3, 359-369.##
[15]  Abbasi, M.; A Azgomi, M.; "Simulation and Modeling Basis Agent of the Smarf DOS Cyber Attack Using Arena Simulation Software"; Proc. Conf. Com. Sci., 2016, (In Persian).##
[16]  Rajaie, A.; "Security Assessment in Cloud Computing and Cyber Attack Simulation "; Proc. Conf. Elec. Bank. Pay. Sys., 2018, (In Persian).##
[17]  Holsopple, J.; Yang, S. J.; "Fusia: Future Situation And Impact Awareness"; Inter. Conf. Inf. Fus., 2008, 1-8.##
[18]  Zhang, Z.; Nait-Abdesselam, F.; Ho, P. H.; "Boosting Markov Reward Models For Probabilistic Security Evaluation By Characterizing Behaviors Of Attacker And Defender"; Inter. Conf. Avail. Reli. & Sec., 2008, 352-359.##
[19]  Wang, B.; Cai, J.; Zhang, S.; Li, J.; "A Network Security Assessment Model Based On Attack-Defense Game Theory"; Inter. Conf. Comp. App. & Sys. Mod., 2010, 639- 643.##
[20]  Canadas, N.; Machado, J.; Soares, F.; Barros, C.; Varela, L.; "Simulation Of Cyber Physical Systems Behaviour Using Timed Plant Models"; J. Mechatronics., 2018, 54, 175-185.##
[21]  Brandstetter V.; Wehrstedt, J. C.; "A Framework For Multidisciplinary Simulation Of Cyber-Physical Production Systems" J. IFAC, 2018, 51, 809-814.##
[22]  Kour, R.; Thaduri, A.; Karim R; "Predictive model for multistage cyber-attack simulation"; Int. J. Syst. Assur. Eng. Manag, 2020, 1-14.##
[23]  Aggarwal, P.; Gonzalez, C.; Dutt, V.; "HackIt: A Real-Time Simulation Tool for Studying Real-World Cyberattacks in the Laboratory"; Springer International Publishing: Cham, 2020.##
[24]  Mayfield, K.P.; Petty, M.D.; Whitaker, T.S.; Cantrell, W.A.; Hice, S.M.; McClendon, J.; Reyes, P.J.; "Component Selection Process in Assembling Cyberattack Simulation Models"; Proc. Int. Conf. Sec. & Manag. 2019, 168-174.##
[25]  Mayfield, K.P.; Petty, M.D.; Whitaker, T.S.; Bland, J.A.; Cantrell, W.A.; "Component-based implementation of cyberattack simulation models", Proc. ACM. Conf. 2019, 64-71.##
[26]  Heidarpour, M.; Rashidi, A. J.; Ahmadi, K. D.; "Cyber Situational Awareness Using Intelligent Information Fusion Engine"; J. Sci., 2015, 36, 3218-3229.##
[27]  Rashidi, A. J.; Jafari, M.; Ahmadi, K. D.; "Projection Of Cyber Attacks By Damage Estimation And Combining Capability And Opportunity Based On Transferable Belief Model"; J. Elec. & Cyb. Def., 2019, 6, 1-12.##
[28]  Zalta, E. N. "Bayes Theorem"; https://plato.stanford.edu/archives/spr2019/entries/bayes-theorem/, 2019.##

Files

History

  • Receive Date: 24 December 2019
  • Revise Date: 10 March 2020
  • Accept Date: 18 March 2020

Share

How to cite

Statistics