Shiro : a centralized system for detecting attacks from windows event logs
TL;DR
The proposed SHIRO system, an attack detection system on the centralized log server that aims to detect and analyze the attacks on Windows 7 clients by focusing on the three most critical Common Vulnerabilities and Exposures, can detect three types of attacks accurately, making this project useful for the administrator to find out the compromised machine directly.
Abstract
Many organizations or companies have experienced the damages of cyberattacks leveraging the MS Windows products' vulnerabilities, especially as numerous personal computers worldwide are still running the older Windows 7 version without installing security patches, which is the weak point that can lead an attacker to exploit them. Therefore, we propose and develop our system called SHIRO for solving these problems, which is an attack detection system on the centralized log server that aims to detect and analyze the attacks on Windows 7 clients by focusing on the three most critical Common Vulnerabilities and Exposures (CVEs), which are CVE 2017-0143 (EternalBlue), CVE 2017-0199 (HTA), and CVE 2019-0708 (Bluekeep). To validate our proposed system, we run the experiments using the Metasploit framework to generate the datasets on each attack type, then the log server collects Event logs from clients, and we analyze the logs by comparing the datasets which are under attack with normal operations. Then, we develop the detection signatures of each CVE from the specific Event logs and their details, so once SHIRO identifies the attack signatures in the records, it identifies the attack type and alerts the administrator. Our experiments, based on both the datasets and the real-time attacks, confirm that SHIRO can detect three types of attacks accurately, making this project useful for the administrator to find out the compromised machine directly; in addition, the security issue can also be resolved by updating the security patches or installing the newer operating system versions. Regarding the implication of this thematic paper, the study of severe vulnerabilities related to the other Windows OS versions should be focused on for the next research, for example, MS Windows 10 which is at the top of the market share operating systems around the world; although it is the newest and more secure operating system, it still has critical vulnerabilities, therefore, we can use a similar method that we proposed in this project to create new detection signatures for the other attack types.