Morwilog: an ACO-based system for outlining multi-step attacks

Abstract

Threat detection is one of the basic mechanisms for protecting a network, as prevention does not suffice. Finding an attack is difficult because the most harmful ones are specially prepared against a specific victim and crafted for the first time. The contribution of a human expert is still needed for their detection, no matter how effective automatic methods used nowadays can appear. Moreover, in many occasions intrusions can only be efficiently detected by analyzing its effects on more than one element in the network. Event and alert recollection offers a way to centralize information from a heterogeneous set of sources. Then, it can be normalized to a common language and analyzed as a whole by a security system. In this paper we propose Morwilog, an ant-inspired method for standing out the relationship between actions belonging to the same complex attack. Morwilog is conceived as a framework for alert correlation to be integrated in a multi-modular security system. Reinforcement learning is incorporated to it thanks to feedback from a human security expert.