Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Modular Framework for Rapidly Building Intrusion Predictors

Xiaoxuan Wang, Rolf Stadler

TL;DR

The paper tackles the infeasibility of building monolithic intrusion predictors for the hundreds of MITRE ATT&CK attacks by introducing a modular, component-based framework that assembles online predictors from reusable building blocks. The approach enables real-time attack-stage prediction, integration of existing systems like Snort, and tunable trade-offs among accuracy, timeliness, and resource use. Through experiments on three public, multi-stage datasets, it demonstrates that 2–4 component chains suffice for effective prediction and introduces a gradual predictor selection method to manage combinatorial complexity. This modular paradigm offers scalable, adaptable intrusion prediction suitable for diverse environments and constraints, advancing practical situational awareness for defenders and automated systems.

Abstract

We study automated intrusion prediction in an IT system using statistical learning methods. The focus is on developing online attack predictors that detect attacks in real time and identify the current stage of the attack. While such predictors have been proposed in the recent literature, these works typically rely on constructing a monolithic predictor tailored to a specific attack type and scenario. Given that hundreds of attack types are cataloged in the MITRE framework, training a separate monolithic predictor for each of them is infeasible. In this paper, we propose a modular framework for rapidly assembling online attack predictors from reusable components. The modular nature of a predictor facilitates controlling key metrics like timeliness and accuracy of prediction, as well as tuning the trade-off between them. Using public datasets for training and evaluation, we provide many examples of modular predictors and show how an effective predictor can be dynamically assembled during training from a network of modular components.

A Modular Framework for Rapidly Building Intrusion Predictors

TL;DR

The paper tackles the infeasibility of building monolithic intrusion predictors for the hundreds of MITRE ATT&CK attacks by introducing a modular, component-based framework that assembles online predictors from reusable building blocks. The approach enables real-time attack-stage prediction, integration of existing systems like Snort, and tunable trade-offs among accuracy, timeliness, and resource use. Through experiments on three public, multi-stage datasets, it demonstrates that 2–4 component chains suffice for effective prediction and introduces a gradual predictor selection method to manage combinatorial complexity. This modular paradigm offers scalable, adaptable intrusion prediction suitable for diverse environments and constraints, advancing practical situational awareness for defenders and automated systems.

Abstract

We study automated intrusion prediction in an IT system using statistical learning methods. The focus is on developing online attack predictors that detect attacks in real time and identify the current stage of the attack. While such predictors have been proposed in the recent literature, these works typically rely on constructing a monolithic predictor tailored to a specific attack type and scenario. Given that hundreds of attack types are cataloged in the MITRE framework, training a separate monolithic predictor for each of them is infeasible. In this paper, we propose a modular framework for rapidly assembling online attack predictors from reusable components. The modular nature of a predictor facilitates controlling key metrics like timeliness and accuracy of prediction, as well as tuning the trade-off between them. Using public datasets for training and evaluation, we provide many examples of modular predictors and show how an effective predictor can be dynamically assembled during training from a network of modular components.

Paper Structure

This paper contains 18 sections, 9 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Use Case
  3. Problem formulation and approach
  4. Our framework for composing online predictors
  5. Experimental setup
  6. Datasets with intrusion attacks
  7. Evaluation metrics
  8. Building and training predictors
  9. Scenario 1: controlling monitoring overhead vs. accuracy
  10. Scenario 2: controlling prediction time vs. accuracy
  11. Scenario 3: controlling sample efficiency vs. accuracy
  12. Scenario 4: controlling training overhead vs. accuracy
  13. Related work
  14. Online intrusion prediction from processing event streams
  15. Intrusion prediction based on IDSs
  16. ...and 3 more sections

Figures (9)

  • Figure 1: The IT infrastructure in the intrusion prediction use case.
  • Figure 2: Event stream observed by the defender.
  • Figure 3: A generic example of two attack stage predictors built from components. Basic event stream 1 and component D are shared by both predictors.
  • Figure 4: Scenario 1: attack predictors for the AIT attack.
  • Figure 5: Scenario 2: attack predictor for the MSCAD attack.
  • ...and 4 more figures