A framework for zero-day vulnerabilities detection and prioritization. (June 2019)

• Record Type: Journal Article
• Authors: Singh, Umesh Kumar; Joshi, Chanchala; Kanellopoulos, Dimitris
• Is Part Of: Journal of information security and applications. Volume 46(2019)
• Page Start: 164
• Page End: 172
• Publication Date: 2019-06
• Subjects: Zero-day attacks -- Exploit -- Vulnerability analysis -- Intrusion detection -- Attack graphs -- AttackRank; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2019.03.011
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Nowadays highly-skilled attackers can find the vulnerabilities of many networked applications. Meanwhile, the risk of a data breach increases dramatically as a software or application vulnerability always remains without a patch. By exploiting such vulnerability (called zero-day), hackers gain entry to the target network and can steal sensitive data. It is challenging to detect zero-day with traditional defenses because signature information in zero-day attacks is unknown. Consequently, a novel security solution is required that will discover zero-day attacks and estimate the severity of identified zero-day vulnerability. In this paper, we propose a framework that constitutes an integrated approach for detection and prioritization (based on likelihood) of zero-day attacks. The proposed framework follows a probabilistic approach for identification of the zero-day attack path and further to rank the severity of identified zero-day vulnerability. It is a hybrid detection-based technique that detects unknown flaws present in the network that are not detected yet. To evaluate the performance of the proposed framework, we adopted it in the network environment of Vikram university campus, India. The framework is very promising as experimental results showed detection rate of 96% for zero-day attacks with 0.3% false positive rate.