Naslov
Systematic Review and Quantitative Comparison of Cyberattack Scenario Detection and Projection

Autori
Kovačević, Ivan ; Groš, Stjepan ; Slovenec, Karlo

Izvornik
Electronics (2079-9292) 9(10) (2020); 1722, 32

Vrsta, podvrsta i kategorija rada
Radovi u časopisima, članak, znanstveni

Ključne riječi
targeted attacks ; attack scenario ; intrusion detection ; alert correlation ; cyber situational awareness ; attack projection

Sažetak
Intrusion Detection Systems (IDSs) automatically analyze event logs and network traffic in order to detect malicious activity and policy violations. Because IDSs have a large number of false positives and false negatives and the technical nature of their alerts requires a lot of manual analysis, the researchers proposed approaches that automate the analysis of alerts to detect large-scale attacks and predict the attacker’s next steps. Unfortunately, many such approaches use unique datasets and success metrics, making comparison difficult. This survey provides an overview of the state of the art in detecting and projecting cyberattack scenarios, with a focus on evaluation and the corresponding metrics. Representative papers are collected while using Google Scholar and Scopus searches. Mutually comparable success metrics are calculated and several comparison tables are provided. Our results show that commonly used metrics are saturated on popular datasets and cannot assess the practical usability of the approaches. In addition, approaches with knowledge bases require constant maintenance, while data mining and ML approaches depend on the quality of available datasets, which, at the time of writing, are not representative enough to provide general knowledge regarding attack scenarios, so more emphasis needs to be placed on researching the behavior of attackers.

Izvorni jezik
Engleski

Znanstvena područja
Računarstvo

POVEZANOST RADA