@inproceedings{924f6f2e5c6347839bce26b1d3777e83,
title = "Towards probabilistic identification of zero-day attack paths",
abstract = "Zero-day attacks continue to challenge the enterprise network security defense. A zero-day attack path is formed when a multi-step attack contains one or more zero-day exploits. Detecting zero-day attack paths in time could enable early disclosure of zero-day threats. In this paper, we propose a probabilistic approach to identify zero-day attack paths and implement a prototype system named ZePro. An object instance graph is first built from system calls to capture the intrusion propagation. To further reveal the zero-day attack paths hiding in the instance graph, our system constructs an instance-graph-based Bayesian network. By leveraging intrusion evidence, the Bayesian network can quantitatively compute the probabilities of object instances being infected. The object instances with high infection probabilities reveal themselves and form the zero-day attack paths. The experiment results show that our system can effectively identify zero-day attack paths.",
author = "Xiaoyan Sun and Jun Dai and Peng Liu and Anoop Singhal and John Yen",
year = "2017",
month = feb,
day = "21",
doi = "10.1109/CNS.2016.7860471",
language = "English (US)",
series = "2016 IEEE Conference on Communications and Network Security, CNS 2016",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "64--72",
booktitle = "2016 IEEE Conference on Communications and Network Security, CNS 2016",
address = "United States",
note = "2016 IEEE Conference on Communications and Network Security, CNS 2016 ; Conference date: 17-10-2016 Through 19-10-2016",
}