Scalable Approach Towards Discovery of Unknown Vulnerabilities

Of all the hazards confronting enterprise IT systems, zeroday vulnerabilities are among the most harmful. Zero-day vulnerabilities are flaws that leave users exposed to network attacks before a patch or work around is available. Every day an exploit remains unpatched, our risk of a data breach increases dramatically. Only a multi-layered approach that fully integrates with organization's IT defense stands a chance of stopping them. This paper presented a novel hybrid three layer architecture framework for zero-day attack detection and risk level assessment with respect to likelihood of exploits. The first layer of the proposed framework is liable to detect the unknown vulnerability which is based on statistical, signature and behavior based techniques; the second layer focuses on risk measurement; and the third physical layer contains centralized database and centralized server that are used during processing of first two layers. The proposed framework is analyzed in network environment of Vikram University Ujjain, India in order to evaluate the performance; experimental results show detection rate of 89% with 3% false positive rate.