Detection of advanced Cyber Attacks, Using Behavior Modeling Based on Natural Language Processing

The complex and persistent attacks of network have been made up of numerous hidden stages. One of the reasons for the ineffectiveness of intrusion detection systems against these attacks is the use of a defense mechanism based on low-level network traffic analysis, in which the hidden relationships between alerts are not addressed. Our assumption is that there is a hidden structural information in traffic data, and we want to define rules in network traffic similar to linguistic rules and use it to describe the patterns of malicious network activity. In this way, the discovery of misuse and anomalous patterns can be well treated as the problem of learning syntactic structures and semantic fragments of the “network language”. In this paper, for the first time in cybersecurity, a new clustering is used named as the clustering of MD_DBSCAN; one of the most advanced types of DBSCAN clustering. In addition, a greedy algorithm inspired by the induction of grammar in natural language processing has been used to recgnize high-level activities and define the relations between activities in different levels, by integrating low-level activities. In the recognition section of high-level activities of the proposed algorithm, for the first time, similarity edition criterion in hierarchical clustering has been added to the existing criteria in the base algorithm. According to ROC curves the results show that the accuracy of detection in higher-level activities are about 30% higher than low-level activities. Also by choosing the best setting for threshold parameters in attack detection algorithms, we had the highest F1 score in different levels from 1 to 3: 72.3 , 96.2, 96.4. which means that in general we have had the improvement of about 0.2 compared to the base algorithm.