Research on Prediction Technique of Network Situation Awareness

Transcription

1 Research on Predcton Technque of Networ Stuaton Awareness Juan Wang,ZhGuang Qn,L Ye School of Coputer Scence and Engneerng Unversty of Electronc Scence and Technology Chengdu, Chna Abstract In ths paper we study on the predcton technque of networ stuaton awareness. It has two levels: the hghlevel stuaton and the lowlevel next attac step. The frst one ncludes the ndexes and the evaluaton results of the networ securty stuaton, they are fgure for, we use the RBF networ to predct the for RBF s selflearnng character. Then we use the weghted attac graph to predct the next attac step. The weghts represent the probablty; the bggest weghts ndcate the ost possble next attac step. The sulatons show these predcton ethods can offer dfferent predcton capablty to satsfy the predcton need of the networ stuaton awareness. Keywords networ stuaton awareness,rbf neural networ, alert analyss I. INTRODUCTION Now, we are n nforaton age, varous nforaton around us, but ore nforaton doesn t ean ore nowledge. Because, ths nforaton s xed up and outoforder, people hard to fnd out useful nowledge they want, ths called an nforaton gap [1]. Then the Stuaton Awareness (SA) s proposed to solve ths proble. SA pays attenton to the nforaton transfor technology between the abstract data and the nowledge understood by person. It has three levels to transfor the data to nowledge: percepton, coprehenson and predcton. Its applcaton n networ securty s called Networ Stuaton Awareness (NSA), frst proposed by T Bass, 1999[5]. Tradtonal networ securty devces such as Intruson Detecton Systes (IDS), frewalls, and securty scanners wor ndependently,wth no nowledge of the networ resource they are defendng. Ths lac of nforaton results n nuerous abgutes when nterpretng alerts and ang decsons on adequate responses. We desgn a nearrealte ontorng syste that converts NetFlow source data and networ securty equpent (e.g., IDS, Frewor, IPS, etc) alerts to vsualzatons of ndvdual and suary statstcs, n graphc and tabular forats. Ths novel networ ontorng syste provdes stuatonal awareness of traffc actvty by geographcal entty (e.g., locaton, organzaton, cty, state, etc), then autoresponse by preconfgure. The syste can decrease the response te of networ decsonang and acton. One portant odule of the syste s predcton; nclude the stuaton predcton, ndexes predcton and the attac step predcton. Supported by Natonal Coputer Securty Center Project of Chna (242 project)under Grant No.2006C27,and the Chna Scholarshp Councl. Accurate predcton s the foundaton of the early warnng, the support of the decsonang. We apply noral predcton technque le RBF neural networs, to predct the stuaton and the ndexes; and the Weghted Attac Graph (WAG, a drected graph) to predct the next attac step that can help networ anager or the syste tself change the networ securty strategy tely. The sulatons show these predcton ethods can offer dfferent predcton capablty to satsfy the predcton need of the networ stuaton awareness. The reander of ths paper s organzed as follows: Secton 2 contans a bref ntroducton of stuatonal awareness and soe related wors. Secton 3 gves a detaled descrpton of predcton ethods. Secton 4 gves the sulaton of our predcton ethods of the NSA syste. We end wth a suary and conclusons n Secton 5. II. NETWORK SITUATIONAL AWARENESS The ter Stuatonal Awareness (SA) coes fro the ltary plot feld, t eans the ablty to dentfy, and coprehenson the crtcal eleents [2]. SA s the foundaton of decsonang t can help people n any felds such as ar traffc controllers, drvng, and ltary operatons [3]. Ensley [4] defned Stuatonal awareness as the percepton of the eleents n the envronent wth a volue of te and space, the coprehenson of ther eanng, and the projecton of ther status n the near future The followng three levels consttute the foral defnton of SA [2]: Level 1 percepton of the eleents n the envronent. Level 2 coprehenson of the current stuaton. Level 3 projecton of future status. The ental odel and the decsonang show n the Fg.1 descrbe the relatonshp of the three levels. Fgure 1. Stuatonal Awareness As enton above, T Bass brng t nto the networ securty research feld [5].He frst use ths NSA dea n /08 /$ IEEE CIS 2008

2 Intruson Detecton Syste (IDS) to fuse data that coe fro ultsensor, and get the nforaton of the rate of ntruson, attacers of ntruson, and the object of the attac, at last offer the evaluaton functon of attac threaten, t s also the stuaton awareness of attac to the user. But he ddn t offer the predcton functon. Other researchers and groups n ths feld nclude Stephen Lau (Lawrence Bereley Natonal Labs) [6], NetSA(The CERT Networ Stuatonal Awareness Group) of CarnegeMellon Unversty[7], Natonal Center for Advanced Secure Systes Research(NCASSR)[8]. These groups put the data fuson technque nto practce, and use the vsualzaton technque proves the dea of T Bass to get awareness of the networ stuaton. These systes offer only the nforaton of the net flow and also lac capablty of predcton, or only predct the net flow. III. PREDICTION OF NETWORK SITUATION AWARENESS The coprehenson process of our NSA syste generates the followng nforaton: a) The ndexes get fro the alerts of the networ securty devces such as SNORT [12]. And the netflow data of the networ connected devces such as CISCO ROUTER. b) The attac graphs get fro alerts that are dsplayed on the user nterface to help networ anager easly locate the source and object of the attacs, and gve anager a good dea of attac strategy. The evaluaton results of the networ stuaton that are floatng pont nubers get fro all of ndexes(how to get we wll report n another paper), The result represent the rs ran fro the low (green) to the hghest severe (red), the rs ran defned as [9]. The ndexes and the evaluaton values are fgures, they have slar character, we use RBF neural networ to predct both of the, for RBF s selflearnng character and the coplex relatons of the ndexes and evaluaton results. For the attac graphs, we add weghts to the attac graph to predct the next attac step. The weght represents the probablty of whch attac wll be the next attac. The detals of these ethods are gven below. The predcaton process of the ndexes s slar to the predcaton of evaluaton values. We descrbe the latter one for exaple A. RBF neural networ based predcton of the stuaton of the NSA Frstly, I sply ntroduce the ndexes and the evaluaton values. One ndex s a feature of networ such as the rate of netflow (783 bt per hour),we defne t as I 1. We totally have thrtyone ndexes (I 1, I 2 I 31 ), all of ndexes are processed to fgure for. As te fles, we can get a te seral values for each ndex, the sae to evaluaton values whch are fgure fro 0 to 1. We use past te values to tran the RBF neural networ, when t ready we use t to predct future values of both ndexes and evaluaton results. Radal bass functon (RBF) neural networ are based on supervsed learnng. The nput nto an RBF networ s nonlnear whle the output s lnear, due to the nonlnear approxaton propertes. RBF networ are able to odel coplex appngs. The transforaton functons used are based on a Gaussan dstrbuton. We use a threelayer nh RBF networ to predct, as the Fg.2.The n s the nuber of nputs, h s the nuber of hdden unts, and the s the nuber of outputs. Fgure 2. Φ1( x c1 ) Φh ( x ch ) W R h Threelayer RBF neural networ T n x = ( x x x The 1, 2, n ) R s the nput feature vector, h C (=1,2,,h) are the center of the hdden data, W R s the output atrx, b 0,,b are the offset of output unt, T y = [ y 1 y ] Φ s the output of the networ, ( ) s the actvaton functon of the th hdden node. Before usng the RBF networs to predct, we need optze the networ paraeters n order to ft the networ outputs to the gven nputs. The ft s evaluated by eans of a cost functon, usually assued to be the ean square error. We tae the followng tranng process: The output of the th hdden unt of the RBF networ s: q = Φ ( x c ) (1) The output of the th output node s: y = ω q θ Algorth: 1) Use as teratve tes, ntalze =1.Then use test X = { X,, } data 1 X 2 X to fnd the centre of the data, ared C 1 l C 1, delegate the centre of lth, th cluster. 2) Suppose the su of node to each cluster center dstance s A(),and the dstance of to ts cluster centre s B(),then suppose R = X, { ax( A( ) B( )), = 1,, }. 3) Eject R fro ts cluster, recount that cluster center, and suppose new center s C j 4) set =+1, that eans ncrease the nuber of cluster fro to =1, ntalze the cluster center s 1 ' 1 ( R 1, C 1,, ( C j ), C 1 ). 5) Calculate the dstance of all nodes to the center n the set X, and dvde the nodes to dfferent cluster whch center s the ost close to the. (2)

3 6) then recount the center C = ( C1 C ),judge whether C have changed or not, changed, then turn to step(5), otherwse contnung to next step; 7) calculate varance of all cluster: D = ( D1 D ) ; 8) suppose the dstance of R to ts cluster center s D ax D,the varance of each cluster s ean,f D ax <ax( Dean ),then clusterng s over, go to next step, f not go to step 2; Now, clusterng s over, each cluster center s fxed. Then use the least square ethod to fnd out each wegh value, then the predcton odule s ready. When we got a set of stuaton evaluaton values, we tae these values as the nput of the RBF networ, and then the RBF networ wll gve us the values of subsequent te. B. Weghted Attac Graph based predcton of the next attac step As enton above, n the coprehenson process we get attac graph fro the alerts, such as Fg.3 shows: Fgure 3. Attac graph How do we get ths graph s not the pont n ths paper, but you can get soe dea fro [10] whch s the base of our ethod. The an dea s before the hacers ntrude nto vct, there are seres attac steps, and early steps prepare for the later ones. So we can defne the prerequstes and consequences of attac (by experence or generated by algorth), then we connect the prerequstes and consequences produce the attac graph. We ntegrate the slar alerts nto hyperalert. One hyperalert s a set of alerts whch have the sae prerequstes and consequences. The alerts n the attac graph are hyperalerts. But when we use the attac graph to predct next attac step, there s a proble that n an attac graph one attac ay has any next steps, such as the node DNSAttac n Fg.3, the next step of t ay be webht or SPortTraffc or Nopsx86.We don t now whch one s the best choce. So n order to predct the next attac, we calculate the le hood of two drect relaton attacs. We call the two drect relaton attac as a preparefor par, the forer one contrbutes to the latter one. All of the preparefor pars and ther weghts (le hood) are stored n a chan table, as the Fg.4 shows: Fgure 4. The weghted preparefor par chan tale A, B, C, D, and E represent a nd of hyperalert. For exaple, DNSAttac s the hyperalert of dnszonetransfer, DNSversonquery, and so on. All of the use DNS to get nforaton of object, we thn the have the sae effect n an real attac so we use a hyperalert DNSAttac to delegate all of the.also the webht s the hyperalert of webcgphf, webcgtestcg, webcghandler, webcgperlexe, webcgnphtestcg, and so on. The N ab n the chan table represent how any tes the par (A, B) appearanced. When we observe a par (A,B) fro the alert strea, the N ab update to N ab +1.Ths nforaton get fro the alerts strea n tranng stage. The Su (*) s su of certan hyperalert appearance nubers. The W s the weght of preparefor par.its coputaton algorth as follows: Algorth 1 preparefor par weght coputaton Let, j be a certan hyperalert; Let (,j) be a preparefor par; Let N (, j) be the appearance nubers of par (,j); Let W (, j) be the weght of par (,j); For all hyperalert n chan table do Copute the su of hyperalert s appearance nubers: Su () = N (,*); W (, j) = N (, j)/su (); After tranng stage, the weght wll change when the predcton s ht or not. Its update algorth as follows: Algorth 2 preparefor par weght update Let (,j) be a preparefor par; Let N (, j) be the appearance nubers of par (,j); Let W (, j) be the weght of par (,j); Let Su () s su of hyperalert appearance tes; For all preparefor par do If the predcton of par (, j) s ht then Update the N (, j) = N (, j) +1; Update the Su () = Su () +1; Update the W (, j) = N (, j)/ Su (); End f We don t update the weght by update all the N (, j), Su (, j), and get W=N/Su. If the alerts and pars are thousands, t s a te consue wor, don t ft our nearrealte need. On the other sde, one ht copare thousands pars and alerts s too few, t cannot contrbute to the weght change obvously, ths also ean t cannot help to get new attac strategy qucly.

4 Lastly, the predcton of next attac algorth as follows: Algorth 3 attac predcton Let I be the attac just happened; Let W (, j) be the weght of par (, j); For all W (, *) n chan table do If the W (, j) s the ax one Return the attac j as the possble next attac End f attacs n Jun data. We get the attac graph Fg.3 fro the 2000 Aprl, now we calculate the weght of each edge, and then we get the weghted attac graph as Fg.6 show. IV. SIMULATION A. RBF neural networ based predcton of the stuaton of the NSA. Our sulated data are the net flow data of Chongqng (one cty of Chna) offered by the Chnese Natonal Networ Securty Centre (CNNSC), we transfored the data nto ndexes, and got the stuaton evaluaton values (one hour get one value) fro to , total 7 days. We used 1924 evaluaton values as tranng data, and the last day as the test data. Our RBF networ s 24h1 structure, has 24 nputs (one day has 24 hours), 1 output (the next hour). We got the predcton values of 25 whole day. Be lted by space we show the forer 7 hours values, the table 1 and the Fg.5 show the predcton values (P), the real values (R),and error between the(e), E = P R. TABLE 1: PREDICTION VALUES AND REAL VALUES P R E Fgure 5. Predcton values and real values The ean error of predcton s , the predcton offset less than 5%, and the trend of the predcton s the sae to the real one, the sulaton shows our RBF networ based predcton ethod of stuaton can eet the need. B. Weghted Attac Graph based predcton of the next attac step We use the Honeypot data [11] to prove the ethod, for the alerts of CNNSC aren t publc. We use the 2000 Aprl, May data to tranng our weght (le hood of preparefor par).and use the weghted attac graph to predct the Fgure 6. The weghted attac graph We can get the nforaton that the ntruson begn wth portscan, for hacers have to fnd who s onlne frst. Then the DNSAttac follows, the result reveals that the vct host has the DNS explots bug whch can be used ntrude nto the vct. Let s see followng alert of Jun 6: Jun 6 22:58:56 lsa snort [8804]: IDS198/SYN FIN Scan: :53 > There was a portscan attac happened Our weghted attac graph shows the next attac ay be DNSAttac or RPCInfoQuery, the forer one happen probablty larger then the latter one. Actually, the DNSAttac happen latter, naed DNSversonquery (Fg.6.red lne fro portscan ).As entons above,we ntegrate the slar alerts nto hyperalert. DNSversonquery belongs to hyperalert DNSAttac. And the weght (portscan, DNSAttac) update to The alert s ths: Jun 6 22:59:12 lsa snort [8804]: IDS/DNSversonquery: :3722> The contnuous 4 days (Jun 69) predcton as the table 2 shows. We can see the ntruson start wth a portscan, then follows a DNSAttac, and a.we ae soe wrong predcton of (fro the DNSAttac node, the follow red lne are our predcton, blue one s the real one).but when the weght update, we can ae correct predcton later. In tranng data the weght of RPCInfoQuery) s too hgh. Actually, before the Jun 6 the attac cae fro networ, and after Jun 6 the attac cae fro networ, they were two dfferent attacs. Although our predcton ethod aes soe stae, the ethod can predct rghtly after the weght changed. Our ethod has adaptablty TABLE 2. FOUR DAYS PREDICTION Day Happened Predcton Real next Update weght(0.1,0.05) attac attac attac 6 Portscan DNSAttac DNSAttac (Portscan,DNSAttac,0.77) 6 DNSAttac RPCInfoQu ery,0.23)

5 7 DNSAttac RPCInfoQu ery 8 DNSAttac 9 DNSAttac V. CONCLUSION RPCInfoQuery,0.31),0.28) RPCInfoQuery,0.26),0.38),0.48) The sulatons show our predcton ethod can predct the hghlevel stuaton and the low level next attac step. Our future research are tranng the RBF networ as set the predcton te unt fro an hour to a day,a wee and a onth, to see the algorth s perforance, and prove the weghted attac graph by consderng soe other nforaton such as source IP. ACKNOWLEDGMENT The wor reported n ths paper was supported n part by Natonal Coputer Securty Center Project of Chna (242 projects) under Grant No.2006C27, naed The Networ Stuaton Awareness and Analyss Syste The organzaton gve us drecton and experental data. Thans the for ther help. And also thans to the support of Chna Scholarshp Councl. REFERENCES [1] M. R. Endsley (2001). Desgnng for stuaton awareness n coplex systes. Proceedngs of the Second ntenatonal worshop on syboss of huans, artfacts and envronent, Kyoto, Japan [2] M. R. Endsley, B. Bolt e, and D.G. Jones. Desgnng.For Stuatonal Awareness, An Approach to UserCentered Desgn. Taylor & Francs, [3] Y. Lvnat,J. Agutter,S. Moon and S. Forest.Vsual Correlaton for Stuatonal Awareness.IEEE Syposu on Inforaton Vsualzaton [4] M. R. Endsley. Desgn and evaluaton for stuaton awareness enhanceent. In Proceedngs of the Huan Factors Socety 32nd Annual Meetng, pages , Santa Monca, CA, Huan Factor Socety. [5] T.Bass, D. Gruber.A glpse nto the future of d. htl, 1999 [6] S. Lau.The spnnng cube of potental doo.councatons of the ACM,2004,47(6):25 26 [7] Carnege Mellon' s SEI. Syste for Internet Level Knowledge (SILK). forge.net,2005 [8] W.Yurc. Vsualzng NetFlows for Securty at Lne Speed:The SIFT Tool Sute.In:19th Usenx Large Installaton Syste Adnstraton Conference(LISA),San Dego,CA USA,Dec.2005 [9] [10] P. Nng and D. Xu. Learnng attac stratages fro ntruson alerts. TR , Dept. of Cop. Sc., NCSU, [11] Honey net project now your eney statstcs[eb/ol] http :// [12] SNORT.