The emerging cyber security threats pose many challenges to security analysts of enterprise multimedia environments when analysts attempting to analyze and reconstruct advanced persistent threats (APTs). APTs analysis activities are both time-consuming and labor-intensive. Attack modeling technology represented by kill chain can reduce the burden of manual provenience analysis. However, existing Cyber Kill Chain models represent attacks as several stages solidly, and they cannot reflect the characteristics of progressive penetration. It is difficult for security analysts to automate the correlation analysis of attack events in practical usage. In this paper, we first analyze current Cyber Kill Chain models and heterogeneous data sources for APTs detection. Then we propose MCKC (Modified Cyber Kill Chain model) that can be used for standardized correlation analysis. MCKC organizes sub-chains into a recursive structure, and different kill chain penetration processes in the same attack scenario are better connected The proposed MCKC model offers a novel approach for bi-directional attack analysis: forward analysis and backward reasoning which can facilitate threat detection effectively without relying too much on expert knowledge. The advantage of MCKC model is that it is more suitable for cognitive reasoning and APTs scenario reconstruction. Compared with existing models MCKC gives a feasible technological process for threat analysis. The result of case study shows that the modified kill chain model is effective in discovering security events and reconstructing APT attacks.
[1]
Kurt Debattista,et al.
An Empirical Evaluation of the Effectiveness of Attack Graphs and Fault Trees in Cyber-Attack Perception
,
2017,
IEEE Transactions on Information Forensics and Security.
[2]
Sergio Caltagirone,et al.
The Diamond Model of Intrusion Analysis
,
2013
.
[3]
Muhammad Salman Khan,et al.
A Cognitive and Concurrent Cyber Kill Chain Model
,
2018,
Computer and Network Security Essentials.
[4]
Hossein Saiedian,et al.
A novel kill-chain framework for remote security log analysis with SIEM software
,
2017,
Comput. Secur..
[5]
Ian Bayley.
Challenges for a Formal Framework for Patterns
,
2014,
Cyberpatterns.
[6]
Nasir D. Memon,et al.
Detecting Structurally Anomalous Logins Within Enterprise Networks
,
2017,
CCS.
[7]
Vijey Thayananthan,et al.
Analytical Techniques for Decision Making on Information Security for Big Data Breaches
,
2017,
Int. J. Inf. Technol. Decis. Mak..
[8]
Ankur Padia,et al.
UCO: A Unified Cybersecurity Ontology
,
2016,
AAAI Workshop: Artificial Intelligence for Cyber Security.
[9]
Jason R. C. Nurse,et al.
Cyber Security Awareness Campaigns: Why do they fail to change behaviour?
,
2014,
ArXiv.