Analyzing Security Vulnerabilities and Attacks

Analysis of network security attacks helps us understand characteristics of application vulnerabilities, intrusion detections techniques and attacker behavior patterns established. Intrusion detection tools and signature-based approaches used in practice are helpful in detecting known attacks but are not as efficient when a new vulnerability is being exploited. Anomaly-based approaches are sometimes able to detect unknown attacks but at the cost of false alarms. Hence there is the need for human expertise intervention in attack investigation. Today, most of this investigative analysis is done more or less manually. It is our aim to propose a measurement based model to provide joint insight into attack patterns and associated vulnerability exploitation. This paper describes a novel approach that combines both vulnerability data from Mitre CVE (Common Vulnerabilities and Exposures) vulnerability database, and attack data from nearly 5000 hosts at National Center for Supercomputing Application (NCSA) located at Illinois, to create an attack model with sufficient details to assist identification of system compromises. Real data is scrutinized to find attack flow patters, which give more insight into strategies adopted by the elite attacker community today. Motivated by these findings, we create a model to capture the relationships between vulnerability exploitation and attack flow. Keyword: vulnerability, attack, real data, classification, model.