Network event-based model using finite state machine to detect and predict insider intrusion on enterprise networks
by T.N. Nisha; Dhanya Pramod
International Journal of Security and Networks (IJSN), Vol. 17, No. 4, 2022

Abstract: Network infrastructure being the backbone of organisations, has become the preferred target for attackers. Hackers pose threat to the network architecture and target the data in storage and in transit mode. In addition to this, insiders with malicious intentions also try to exploit access, therefore organisations need to detect and deal with such attempts. In this paper, we propose a finite state machine-based attack probability detection model to detect insider attacks on enterprise network. The model consists of a knowledge-based finite state machine and a probability-based IPAM algorithm that gives high detection rates and less false positives. The approach uses a novel composition wherein the event sequences are generated for each pair of connected hosts using the state machine and then fed to probability component for further analysis and ascertaining the network safety level. The proposed approach defends the denial of service attacks and scanning probes. The model works in the lower layers of the network protocol stack and hence the detection characteristics can be easily extended to protect against new attacks.

Online publication date: Wed, 23-Nov-2022

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Security and Networks (IJSN):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com