Poster Abstract: An Unsupervised Two-Layer Multi-Step Network Attack Detector

Nowadays, attackers tend to perform several steps to complete a cyber attack named multi-step network attack which is different from the traditional network attack. Plenty of studies carried on multi-step attack detection use rule-based intrusion detection system (IDS) alerts as source while rule-based IDS relies heavily on its rule set. It is hard for IDS rule set to detect every anomaly behavior and once some attack steps do not cause alert, the subsequent multi-step attack detection will be affected. In this poster, we present a novel unsupervised two layer multi-step attack detector. In the first layer, we propose Dynamic Threshold Time Decay Frequent Item Mining to detect those steps IDS cannot generate alert and in the second layer, we utilize Heuristic Alarm Clustering method to detect the multi step attack scenario. The results of evaluation on IDS2012 dataset show that our detector can significantly reduce the false negative rate (FNR) of Suricata IDS.