A Process Mining-based approach for Attacker Profiling

 

Autor(es):
Rodríguez, Marcelo ; Betarte, Gustavo ; Calegari, Daniel
Tipo:
Preprint
Versión:
Enviado
Resumen:

Reacting adequately to cybersecurity attacks requires observing the attackers’ knowledge, skills, and behaviors to examine their influence over the system and understand the characteristics associated with these attacks. Profiling an attacker allows generating security countermeasures that can be adopted even from the design of the systems. For automated attackers, e.g. malware, it is possible to identify some structured behavior, i.e. a process-like behavior consisting of several (partial) ordered activities. Process Mining (PM) is a discipline from the organizational context that focuses on analyzing the event logs associated with executing the system’s processes to discover many aspects of process behavior. Few proposals are applying PM to attacker profiling. In this work, we explore the use of PM techniques to identify the behavior of cyber attackers. In particular, we illustrate, using an application example, how they can be adapted to an environment dominated by automated attackers. We discuss preliminary results and provide guidelines for future work.

Año:
2021
Idioma:
Inglés
Temas:
Cybersecurity
Process mining
Behaviour
Malware
Institución:
Universidad de la República
Repositorio:
COLIBRI
Enlace(s):
https://hdl.handle.net/20.500.12008/29279
Nivel de acceso:
Acceso abierto