A Closer Look at Attack Clustering

Worms cause correlated failure of many systems in a short span of time. Therefore, automated defensive approaches have been proposed to counter growth of worms. However, in addition to worms, many other kinds of cyber-attacks also exhibit significant correlation, albeit with slightly different properties. We argue that those specific correlation properties manifest because of the interaction between the attacker and the defender strategies. We survey the design space of defensive approaches and observe the extent of clustering (correlation) in attacks that these approaches are likely to induce. We highlight the implications of attack clustering on individual firms deploying these various approaches and also on global actors like government and cyber-insurance providers. We use 19 months of honeynet attack data to estimate clustering for some non-worm type attacks.