PROFILING HACKERS' SKILL LEVEL BY STATISTICALLY CORRELATING THE RELATIONSHIP BETWEEN TCP CONNECTIONS AND SNORT ALERTS Khiem Lam

Challenges to Troubleshooting Compromised Network  Time consuming to find vulnerabilities  Difficult to determine planted exploits  Uncertain of the degree of damage

Motivation for Profiling Hackers  Can profiling the attacker’s skill level assist with risk management?  Understand the level of threat  Know the possibilities of vulnerabilities  Reduce time and resource to investigate the “what if” scenarios

Approach - Hypothesis of Skilled Attacker’s Behavior  Avoid IDS detection if they know the rule set in advance  Avoid common techniques to reduce chances of detection  Establishes many short connections  If these hypothesis are true, then there must be patterns to group attackers based on their behavior!

Exploratory Approach Data Acquisition/Separation Data Standardization/Formatting Cluster Analysis

Phase 1 – Data Acquisition/Separation Competition Snort Alerts Logs Updated Snort Alerts Logs TCP Connection DataIDS Alerts Data Competition PCAP Captures Team A’s Pcap Team B’s Pcap Team A Connection Info Team B Connection Info Snort Application

Phase 2 – Data Standardization Team A Connection Info Updated Snort Alerts Logs Data Aggregation using R Statistical Tool Competition Snort Alerts Logs CSV Format Team A’s Aggregated Data by Time Period

Phase 2 – Example of Actual Aggregated Data This is the aggregated data for two teams connecting to one service

Results – Graph of the Aggregated Data

Phase 3 – Cluster Analysis Using R Find correlation between attributes Add weights Team A’s Aggregated Data by Time Period Team B’s Aggregated Data byTime Period Team C’s Aggregated Data by Time Period Cluster Data Euclidean Distance Cluster Analysis Results + Graphs

Phase 3 - Example of Actual Cluster Data This is the cluster data of all teams connecting to one service

Results – Euclidean Cluster Graph Team# flags submitted

Results – K-Mean Cluster K-Mean Cluster Plot Team# flags submitted

Limitations of Current Approach  Rely on competition data (time period, team subnet info)  Assume attackers know of competition alerts in advance  Assume submitted flags is reliable criteria to measure attacker’s skills  Inconsistency between different services

Future Work for Improvement  Experiment with varying time period (5 minutes, 15 minutes, 30 minutes)  Increase updated alert rules to capture more events  Add additional features (Andrew and Nikunj’s TCP stream distance)  Weigh the correlation between attributes  Explore other R’s analysis

Questions?