An Advanced Security Event Visualization Method for Identifying Real Cyber Attacks

Authors

Jungsuk Song, Korea Institute of Science and Technology Information, Daejeon, KoreaFollow
Takayuki Itoh, Ochanomizu University, Tokyo, JapanFollow
GilHa Park, Chungnam National University Hospital, Daejeon, KoreaFollow
Hiroki Takakura, National Institute of Informatics, Tokyo, JapanFollow

Author Country (or Countries)

Japan

Abstract

Most organizations deploy and operate intrusion detection system (IDS) on their networks in order to defend their vital computer and network resources from malicious cyber attackers. Although IDS has been contributed to the improvement of network security, there is a fatal problem in that it records the tremendous amount of alerts, so that security operators are unable to deal with all of them and it is inevitable to miss real cyber attacks from the recorded IDS alerts. Many visualization methods of IDS alerts have been proposed in order to cope with this issue, but their main objective is to better understand only overall attack situations, not to detect real cyber attacks. In this paper, we propose an advanced visualization method of IDS alerts based on machine learning and statistical features derived from IDS alerts. The proposed visualization method can be contributed to the reduction of IDS alerts that must be analyzed by security operators and to effectively identify real cyber attacks from IDS alerts.

Digital Object Identifier (DOI)

http://dx.doi.org/10.18576/amis/110202

Recommended Citation

Song, Jungsuk; Itoh, Takayuki; Park, GilHa; and Takakura, Hiroki (2017) "An Advanced Security Event Visualization Method for Identifying Real Cyber Attacks," Applied Mathematics & Information Sciences: Vol. 11: Iss. 2, Article 2.
DOI: http://dx.doi.org/10.18576/amis/110202
Available at: https://digitalcommons.aaru.edu.jo/amis/vol11/iss2/2