Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time

  • Renier van Heerden
  • Mercia M. Malan
  • Francois Mouton
  • Barry Irwin
Conference paper

DOI: 10.1007/978-3-662-44208-1_23

Volume 431 of the book series IFIP Advances in Information and Communication Technology (IFIPAICT)
Cite this paper as:
van Heerden R., Malan M.M., Mouton F., Irwin B. (2014) Human Perception of the Measurement of a Network Attack Taxonomy in Near Real-Time. In: Kimppa K., Whitehouse D., Kuusela T., Phahlamohlaka J. (eds) ICT and Society. HCC 2014. IFIP Advances in Information and Communication Technology, vol 431. Springer, Berlin, Heidelberg

Abstract

This paper investigates how the measurement of a network attack taxonomy can be related to human perception. Network attacks do not have a time limitation, but the earlier its detected, the more damage can be prevented and the more preventative actions can be taken. This paper evaluate how elements of network attacks can be measured in near real-time(60 seconds). The taxonomy we use was developed by van Heerden et al (2012) with over 100 classes. These classes present the attack and defenders point of view. The degree to which each class can be quantified or measured is determined by investigating the accuracy of various assessment methods. We classify each class as either defined, high, low or not quantifiable. For example, it may not be possible to determine the instigator of an attack (Aggressor), but only that the attack has been launched by a Hacker (Actor). Some classes can only be quantified with a low confidence or not at all in a sort (near real-time) time. The IP address of an attack can easily be faked thus reducing the confidence in the information obtained from it, and thus determining the origin of an attack with a low confidence. This determination itself is subjective. All the evaluations of the classes in this paper is subjective, but due to the very basic grouping (High, Low or Not Quantifiable) a subjective value can be used. The complexity of the taxonomy can be significantly reduced if classes with only a high perceptive accuracy is used.

Keywords

Network Attack near real-time Network Attack Taxonomy 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© IFIP International Federation for Information Processing 2014

Authors and Affiliations

  • Renier van Heerden
    • 1
  • Mercia M. Malan
    • 2
  • Francois Mouton
    • 1
  • Barry Irwin
    • 3
  1. 1.Defence Peace Safety & SecurityCouncil for Industrial and Scientific ResearchPretoriaSouth Africa
  2. 2.Information and Computer Security Architecture Research GroupUniversity of PretoriaPretoriaSouth Africa
  3. 3.Computer Science DepartmentUniversity of RhodesGrahamstownSouth Africa