Distributed Attack Modeling Approach Based on Process Mining and Graph Segmentation

Area of Science:

• Cybersecurity
• Computer Science
• Data Mining

Background:

• Attack graph modeling aids network security by analyzing intrusion alerts to understand attacker strategies.
• Current methods lack a high-level view, hindering comprehensive analysis of complex cyber threats.
• Manual analysis of detailed attack graphs is challenging and time-consuming for security administrators.

Purpose of the Study:

• To develop advanced algorithms for generating more interpretable and scalable attack graphs.
• To address the limitations of existing methods in providing a global perspective on attack strategies.
• To enhance the efficiency and accuracy of cyberattack modeling for network security.

Main Methods:

• Employed a heuristic process mining algorithm to generate initial attack graphs from alert data.
• Developed a graph segmentation algorithm to simplify complex attack graphs into manageable subgraphs.
• Proposed distributed algorithms using Hadoop MapReduce and Spark GraphX for handling large-scale alert data.

Main Results:

• The heuristic process mining algorithm generates complete but complex initial attack graphs.
• The proposed graph segmentation algorithm effectively simplifies complex graphs while preserving structure.
• Distributed algorithms demonstrate significant improvements in accuracy and efficiency for large datasets.
• Experimental validation confirms superior performance over comparative algorithms.

Conclusions:

• The developed algorithms offer a more effective approach to attack graph modeling in network security.
• Improved interpretability and scalability facilitate better understanding and response to cyber threats.
• The distributed approach is crucial for analyzing massive volumes of security alert data efficiently.