Tiresias: Predicting Security Events Through Deep Learning

by   Yun Shen, et al.

With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps that will be taken by an adversary when performing an attack. However this is still an open research problem, and previous research in predicting malicious events only looked at binary outcomes (e.g., whether an attack would happen or not), but not at the specific steps that an attacker would undertake. To fill this gap we present Tiresias, a system that leverages Recurrent Neural Networks (RNNs) to predict future events on a machine, based on previous observations. We test Tiresias on a dataset of 3.4 billion security events collected from a commercial intrusion prevention system, and show that our approach is effective in predicting the next event that will occur on a machine with a precision of up to 0.93. We also show that the models learned by Tiresias are reasonably stable over time, and provide a mechanism that can identify sudden drops in precision and trigger a retraining of the system. Finally, we show that the long-term memory typical of RNNs is key in performing event prediction, rendering simpler methods not up to the task.


page 1

page 2

page 3

page 4


Predicting Clinical Events by Combining Static and Dynamic Information Using Recurrent Neural Networks

In clinical data sets we often find static information (e.g. patient gen...

One-class Collective Anomaly Detection based on Long Short-Term Memory Recurrent Neural Networks

Intrusion detection for computer network systems has been becoming one o...

How do Mixture Density RNNs Predict the Future?

Gaining a better understanding of how and what machine learning systems ...

ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks

Despite the fact that cyberattacks are constantly growing in complexity,...

Semisupervised Adversarial Neural Networks for Cyber Security Transfer Learning

On the path to establishing a global cybersecurity framework where each ...

FortuneTeller: Predicting Microarchitectural Attacks via Unsupervised Deep Learning

The growing security threat of microarchitectural attacks underlines the...

Reconfigurable Intelligent Surfaces: The New Frontier of Next G Security

RIS is one of the significant technological advancements that will mark ...

Please sign up or login with your details

Forgot password? Click here to reset