Attacker Behaviour Profiling using Stochastic Ensemble of Hidden Markov Models. (arXiv:1905.11824v2 [cs.LG] UPDATED)

Cyber threat intelligence is one of the emerging areas of focus in
information security. Much of the recent work has focused on rule-based methods
and detection of network attacks using Intrusion Detection algorithms. In this
paper we propose a framework for inspecting and modelling the behavioural
aspect of an attacker to obtain better insight predictive power on his future
actions. For modelling we propose a novel semi-supervised algorithm called
Fusion Hidden Markov Model (FHMM) which is more robust to noise, requires
comparatively less training time, and utilizes the benefits of ensemble
learning to better model temporal relationships in data. This paper evaluates
the performances of FHMM and compares it with both traditional algorithms like
Markov Chain, Hidden Markov Model (HMM) and recently developed Deep Recurrent
Neural Network (Deep RNN) architectures. We conduct the experiments on dataset
consisting of real data attacks on a Cowrie honeypot system. FHMM provides
accuracy comparable to deep RNN architectures at significant lower training
time. Given these experimental results, we recommend using FHMM for modelling
discrete temporal data for significantly faster training and better performance
than existing methods.