Real Time Attacker Behavior Pattern Discovery and Profiling Using Fuzzy Rules

Abstract

Computer security investigation would benefit from more information about the characteristics of the human attacker behind a security incident. Present security mechanisms focus on the characteristics of attack, rather than that of the attacker. Attacker behavior analysis is a challenging problem, as relevant data cannot be found easily. We apply cognitive analysis on the network traffic data logs to find the attacker category and infer his intentions. We propose a Fuzzy-rule based approach to categorize the attacker. To make the system more resilient, the attacker’s profile is subjected to behavioral analysis. Real time case study results assert that the proposed technique achieves a good accuracy in classifying the attacker, by discovering the attacker’s behavioral pattern. Further it can be used to assist security and forensic investigators in profiling human attackers.