An Attack Pattern Framework for Monitoring Enterprise Information Systems

Intrusion detection systems (IDS) look for digital patterns mainly over the network or host traffic. Increasing complexity of todays enterprise information systems (EIS) obliges enterprises to deploy multiple but yet isolated IDSs in their IT boundaries, namely in, network (NIDS), host (HIDS), DMZs and application (appIDS). Modern exploits being able to disguise may appear innocent from an individual IDS perspective, however, its maliciousness could be detected from an end to end application perspective. One of the core problems in this regard is the inability of detecting such end to end targeted attacks whose functional scopes may stretch across IT boundaries. In this paper, we first argue that complex end to end intrusions can be detected in real time by analyzing application level logs originating from various IT boundaries (network, proxy, web server, OS, application etc.). We propose an attack pattern framework for EIS that enables an appIDS, such as SAP Enterprise Threat Detection (ETD) [1], to perform log analysis simultaneously from multiple sources. The framework includes a reference architecture and its prototypical implementation can be the core engine of an appIDS. It also provides an attack pattern specification language and associated methodology for managing attack pattern lifecycle and appropriate alert mitigation response.