UCL Discovery
UCL home » Library Services » Electronic resources » UCL Discovery

Tiresias: Predicting Security Events Through Deep Learning

Shen, Y; Mariconti, E; Vervier, P-A; Stringhini, G; (2018) Tiresias: Predicting Security Events Through Deep Learning. In: CCS '18 Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. (pp. pp. 592-605). Association for Computing Machinery (ACM): New York, NY, USA. Green open access

[thumbnail of main.pdf]
Preview
Text
main.pdf - Accepted version

Download (1MB) | Preview

Abstract

With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps that will be taken by an adversary when performing an attack. However this is still an open research problem, and previous research in predicting malicious events only looked at binary outcomes (eg. whether an attack would happen or not), but not at the specific steps that an attacker would undertake. To fill this gap we present Tiresias xspace, a system that leverages Recurrent Neural Networks (RNNs) to predict future events on a machine, based on previous observations. We test Tiresias xspace on a dataset of 3.4 billion security events collected from a commercial intrusion prevention system, and show that our approach is effective in predicting the next event that will occur on a machine with a precision of up to 0.93. We also show that the models learned by Tiresias xspace are reasonably stable over time, and provide a mechanism that can identify sudden drops in precision and trigger a retraining of the system. Finally, we show that the long-term memory typical of RNNs is key in performing event prediction, rendering simpler methods not up to the task.

Type: Proceedings paper
Title: Tiresias: Predicting Security Events Through Deep Learning
Event: ACM Conference on Computer and Communications Security (CCS 2018), 15 - 19 October 2018, Toronto, Canada
Location: Toronto, Canada
Dates: 15 October 2018 - 18 October 2018
ISBN-13: 978-1-4503-5693-0
Open access status: An open access version is available from UCL Discovery
DOI: 10.1145/3243734.3243811
Publisher version: https://doi.org/10.1145/3243734.3243811
Language: English
Additional information: This version is the author accepted manuscript. For information on re-use, please refer to the publisher’s terms and conditions.
UCL classification: UCL
UCL > Provost and Vice Provost Offices > UCL BEAMS
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science
UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Security and Crime Science
URI: https://discovery.ucl.ac.uk/id/eprint/10054503
Downloads since deposit
0Downloads
Download activity - last month
Download activity - last 12 months
Downloads by country - last 12 months

Archive Staff Only

View Item View Item