A Data Mining Approach for Predicting Attacks and Recognizing Threat Strategy in the context of Collaborative Attackers and Network Security Management

Abstract

Data Mining has been novel in predictive modeling. In fact, various Data Mining Models have been used to predict future attacks and recognize threat strategy. However, none has been applied to predict attack and recognize threat strategy in the context of Collaborative Attacker and Victim. In recent times, Internet-facilitated Threats such as botnet and advanced persistent threats have been responsible for most successful attacks in organisations while multiple targets have been the victims of the attacks. Hence, this paper presents a Data Mining Approach for predicting attacks and recognizing threat strategy in the context of Collaborative Attacker and Victim Systems. An Actionable Sequential Association Data Mining Model is developed to mine attack sequences from a repository of Central Administrative System. Plymouth University and MIT Lincoln Lab LLDOS 1.0 Attacker and Victim scenarios are used to evaluate the model. The predictability of the Data Mining Model records 100% accuracy in all scenarios examined. This shows that threats in the context of Collaborative Attackers and Victims are better predicted using Threat Prediction Model that incorporatesactionable attributes and context into data mining