A Multi-Step Attack-Correlation Method with Privacy Protection

In the era of global Internet security threats, there is an urgent need for different organizations to cooperate and jointly fight against cyber attacks. We present an algorithm that combines a privacy-preserving technique and a multi-step attack-correlation method to better balance the privacy and availability of alarm data. This algorithm is used to construct multistep attack scenarios by discovering sequential attack-behavior patterns. It analyzes the time-sequential characteristics of attack behaviors and implements a support-evaluation method. Optimized candidate attack-sequence generation is applied to solve the problem of pre-defined association-rule complexity, as well as expert-knowledge dependency. An enhanced ¿-anonymity method is applied to this algorithm to preserve privacy. Experimental results indicate that the algorithm has better performance and accuracy for multi-step attack correlation than other methods, and reaches a good balance between efficiency and privacy.