A Early Detection of Cyber Security Threats using Structured Behavior Modeling

The rapid evolution of network intrusions has rendered traditional Intrusion Detection Systems (IDS) insufficient for cyber attacks such as the Advanced Persistent Threats (APT), which are sophisticated and enduring network intrusion campaigns comprising multiple imperceptible steps of malicious cyber activities. Dealing with such elaborated network intrusions calls for novel and more proactive defense methodologies. In this paper, we propose an effective early intrusion detection system called SID based on structured modeling of cyber attack behavior, which aims to discover the underlying high-level behavioral patterns within network traffic that are likely to be early signs of cyber attacks. Our system is capable of detecting cyber attacks in their early phases so that courses of defense actions can be made in advance of real compromises. Our experiments on the KDD99 dataset show that using high-level behavioral patterns for predicting cyber attacks achieves much better performance than that of using low-level analysis of network traffic, which is a standard approach in current IDS. F1 scores of more than 0.9 are reported for early detection of network attacks in the KDD99 dataset within windows of certain sizes.