A Real-Time Attack Detection Scheme Based on Multi-Source Information with False Flag Data

In recent years, the issue of cyber security has received unprecedented widespread attention and in-depth research. Network false flag attacks have characteristics of stealthiness and persistence, which leads to the static feature matching-based methods misjudging the attack category. At present, the dynamic behavior detection methods based on audit logs have the disadvantages of low reliability, poor real-time performance and low efficiency. Therefore, in this paper, we propose a multidimensional information-based network false flag attacks detection method, which generates state subgraphs by extracting and processing real-time operation information and audit logs of the system. Then, by comparing the clustering results of the current system operation with the historical state, we determine whether the behavior is malicious or not. For malicious behaviors, we cluster the behaviors with the same purpose into groups, and the security analysts label the attack type of each group. The subsequent behaviors can be automatically labeled with attack type according to their clustering results and therefore realize semi-supervised classification. We demonstrate the effectiveness of our method in an attack scenario, our approach achieves an accuracy of 94.55% for false flag attacks detection and an accuracy of 89.62% for semi-supervised classification.