A predictive threat model for efficient management of distributed organized minor network threats

Abstract

Network threats can be classified into major network threats and minor network threats. Minor network threats are the
network threats that have little or no negative impacts on information systems. Existing Information Security Management
processes have ignored minor network threats because of the perception that they were non-harmful. However, recent
studies have shown that organized minor network threats from distributed sources can cause denial of service attacks.
This paper presents a predictive threat model for managing distributed organized minor network threats. Sequential
Association Mining with multiple actionable attributes was used to extract interesting minor network threats. Attacker
and Victim perspectives of intrusion were combined by Belief Theory to improve the rating accuracy. DARPA-sponsored
Lincoln Lab Denial of Service and real life Plymouth University Advanced Persistent Threat scenarios of minor network
threats were used independently to evaluate the model. The results showed that in both scenarios, distributed organized
minor network threats were rated objectively with positive correlation significance. This eventually reduced the number
of signature rules and time of detection.