Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing

Q: How can I download an article?

To download an article from SID, first log in to the site, search for the article title, and click on the 'Download Article' option.

Q: How can I download an ISI article?

To download an ISI article on SID, enter the keyword or article title in the search bar, view the relevant results, click on the desired article, and select the 'Download Article' option.

Q: How can I access the SID database?

To access the SID database, visit SID.ir, create an account, and log in to access scientific resources.

Q: Is downloading articles from SID free?

Some articles on SID are available for free, while others require payment. Details are specified on the article's page.

DADASHTABAR AHMADI K.; KHEIRKHAH M.; Rashidi A. J.

Scientific Information Database (SID) - Trusted Source for Research and Academic Resources

Journal Paper

Paper Information

Journal: JOURNAL OF ELECTRONIC AND CYBER DEFENCE Year:2018 | Volume:6 | Issue:3 (23) Page(s): 141-151

Download Full-Text

مرکز اطلاعات علمی Scientific Information Database (SID) - Trusted Source for Research and Academic Resources

Persian Verion

View:

1,868

Download:

Cites:

Information Journal Paper

Title

Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing

Author(s)

DADASHTABAR AHMADI K. | KHEIRKHAH M. | Rashidi A. J. | Issue Writer Certificate

Keywords

BehaviorQ1

Advanced Persistent ThreatsQ1

Cyber AttacksQ1

Data FusionQ1

Natural Language ProcessingQ2

Abstract

The complex and persistent attacks of network have been made up of numerous hidden stages. One of the reasons for the ineffectiveness of intrusion detection systems against these attacks is the use of a defense mechanism based on low-level network traffic analysis, in which the hidden relationships between alerts are not addressed. Our assumption is that there is a hidden structural information in traffic data, and we want to define rules in network traffic similar to linguistic rules and use it to describe the patterns of malicious net-work activity. In this way, the discovery of misuse and anomalous patterns can be well treated as the prob-lem of learning syntactic structures and semantic fragments of the “ network language” . In this paper, for the first time in cybersecurity, a new clustering is used named as the clustering of MD_DBSCAN; one of the most advanced types of DBSCAN clustering. In addition, a greedy algorithm inspired by the induction of grammar in Natural Language Processing has been used to recgnize high-level activities and define the rela-tions between activities in different levels, by integrating low-level activities. In the recognition section of high-level activities of the proposed algorithm, for the first time, similarity edition criterion in hierarchical clustering has been added to the existing criteria in the base algorithm. According to ROC curves the results show that the accuracy of detection in higher-level activities are about 30% higher than low-level activities. Also by choosing the best setting for threshold parameters in attack detection algorithms, we had the highest F1 score in different levels from 1 to 3: 72. 3, 96. 2, 96. 4. which means that in general we have had the im-provement of about 0. 2 compared to the base algorithm.

Cites

No record.

References

No record.

Cite

APA: Copy

DADASHTABAR AHMADI, K., KHEIRKHAH, M., & Rashidi, A. J.. (2018). Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing. JOURNAL OF ELECTRONIC AND CYBER DEFENCE, 6(3 (23) ), 141-151. SID. https://sid.ir/paper/243180/en

Vancouver: Copy

DADASHTABAR AHMADI K., KHEIRKHAH M., Rashidi A. J.. Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing. JOURNAL OF ELECTRONIC AND CYBER DEFENCE[Internet]. 2018;6(3 (23) ):141-151. Available from: https://sid.ir/paper/243180/en

IEEE: Copy

K. DADASHTABAR AHMADI, M. KHEIRKHAH, and A. J. Rashidi, “Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing,” JOURNAL OF ELECTRONIC AND CYBER DEFENCE, vol. 6, no. 3 (23) , pp. 141–151, 2018, [Online]. Available: https://sid.ir/paper/243180/en

Related Journal Papers