Research on Distributed Wireless Multi-Step Attack Pattern Mining Method for WLAN

Guanlin Chen; Zebing Wang; Yong Zhang

doi:10.3969／j.issn.1000-0801.2013.11.007

您当前的位置：

首页 >

文章列表页 >

Research on Distributed Wireless Multi-Step Attack Pattern Mining Method for WLAN

research and development | 更新时间：2024-06-05

- Research on Distributed Wireless Multi-Step Attack Pattern Mining Method for WLAN
- Telecommunications Science Vol. 29, Issue 11, Pages: 38-44(2013)
- 作者机构：
  
  1. 浙江大学城市学院计算机与计算科学学院杭州310015
  2. 浙江大学计算机学院杭州310027
- 作者简介：
- 基金信息：
- DOI：10.3969／j.issn.1000-0801.2013.11.007
  CLC：
- Published Online：2013-11，
  
  Published：20 November 2013
- 稿件说明：
移动端阅览
Guanlin Chen, Zebing Wang, Yong Zhang. Research on Distributed Wireless Multi-Step Attack Pattern Mining Method for WLAN[J]. Telecommunications science, 2013, 29(11): 38-44.
DOI：

Guanlin Chen, Zebing Wang, Yong Zhang. Research on Distributed Wireless Multi-Step Attack Pattern Mining Method for WLAN[J]. Telecommunications science, 2013, 29(11): 38-44. DOI： 10.3969／j.issn.1000-0801.2013.11.007.

摘要

入侵检测和防御技术作为网络安全防护的重要手段，在传统有线网络环境中已有较为成熟的应用。但由于无线网络的特殊性，仍很少看到WLAN领域无线多步攻击规划识别的研究。提出了一种融合IEEE 802.11协议帧主要属性进行关联分析的分布式无线多步攻击模式挖掘（DWMAPM）方法。该方法包括构造全局攻击库、建立候选攻击链、筛选候选攻击链、关联多步攻击行为和识别多步攻击模式5个步骤。实验结果表明，DWMAPM方法能够适用于WLAN的真实攻击场景，有效挖掘出多种常见的无线多步攻击模式，可以为多步攻击意图预先识别提供基础。

Abstract

As the important means of network security

intrusion detection and prevention technology have seen some preliminary applications in the traditional wired network environment. Due to the distinctive characteristics of wireless network

the applications of multi-stage attack plan recognition for WLAN are rarely seen in spite of the promising potential. A distributed wireless multi-step attack pattern mining（DWMAPM）method based on correlation analysis with the IEEE 802.11 protocol frame attributes was proposed. The method consists of five steps:constructing a global attack database

building candidate attack chains

filtering candidate attack chains

correlating multi-step attack behaviors and recognizing multi-step attack patterns. Experimental results show that DWMAPM is effective for recognizing a variety of typical attack patterns in real WLAN attack scenarios

and can provide a basis for forecasting the final attack plans.

关键词

Keywords

references

中国互联网络信息中心（CNNIC）．第32次中国互联网络发展状况统计报告． http://www.cnnic.cn/gywm/xwzx/rdxw/rdxx/201307/t20130717_40663.htm http://www.cnnic.cn/gywm/xwzx/rdxw/rdxx/201307/t20130717_40663.htm , 2013

Percoco N J . Trustwave 2012 Global Security Report . Chicago:Trustware SpiderLabs , 2012

陈观林，冯雁，王泽兵．分布式无线入侵防御系统预先决策引擎研究．电信科学， 2010 , 26 （ 10 ）: 80 ～ 86

Geib C W , Goldman R P . Plan recognition in intrusion detection systems . Proceedings of DARPA Information Survivability Conference and Exposition（DISCEX IIˊ01） , Anaheim,USA , 2001

Geib C W , Goldman R P . Probabilistic plan recognition for hostile agents . Proceedings of the Fourteenth International Florida Artificial Intelligence Research Society Conference （FLAIRS 2001） , Key West, USA , 2001

Sheyner O , Haines J , Jha S , et al . Automated generation and analysis of attack graphs . Proceedings of the 2002 IEEE Symposium on Security and Privacy（SP'02） , Oakland, USA , 2002

Ning P , Cui Y , Reeves D S . Constructing attack scenarios through correlation of intrusion alerts . Proceedings of the 9th ACM Conference on Computer and Communications Security （CCS'02） , Washington, DC, USA , 2002

Ning P , Cui Y , Reeves D S , et al . Techniques and tools for analyzing intrusion alerts . ACM Transactions on Information and System Security , 2004 , 7 （ 2 ）: 274 ～ 318

Cuppens F , Miège A . Alert correlation in a cooperative intrusion detection framework . Proceedings of the IEEE Symposium on Security and Privacy , Oakland, California, USA , 2002

Hellerstein J L , Ma S , Perng C S . Discovering actionable patterns in event data . IBM Systems Journal , 2002 , 41 （ 3 ）: 475 ～ 493

Qin X Z , Lee W K . Attack plan recognition and prediction using causal networks . Proceedings of the 20th Annual Computer Security Applications Conference（ACSAC 2004） , Tucson, USA , 2004

Wang L , Ghorbani A , Li Y . Automatic multi-step attack pattern discovering . International Journal of Network Security , 2010 , 10 （ 2 ）: 142 ～ 152

Views

502

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on the application of quantum-secure algorithms in 5G network

Research on new energy station network security assessment method based on improved LSTM network

Application research on network security operation automation practice based on RPA technology

Challenges and innovative solutions of space-ground integrated network security

Development trends of information and communication technology

Related Author

WANG Congli

LI Jinhui

WANG Jingran

XUE Weijia

WANG Jinhua

WANG Qianran

LIU Shan

LI Rui

Related Institution

National Engineering Research Center of Cloud and Network Infrastructure Security

China Telecom Research Institute

State Grid Shanxi Electric Power Company

State Grid Shanxi Electric Power Research Institute

Software Research Institute of China United Network Co., Ltd.

⁰