Abstract:As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this end, we propose SPARSE, an efficient and real-time system for constructing critical component graphs (i.e., consisting of critical events) from streaming logs. Our key observation is 1) Critical events exist in a suspicious semantic graph (SSG) composed of interaction flows between suspicious entities, and 2) Information flows that accomplish attacker's goal exist in the form of paths. Therefore, SPARSE uses a two-stage framework to implement attack investigation (i.e., constructing the SSG and performing path-level contextual analysis). First, SPARSE operates in a state-based mode where events are consumed as streams, allowing easy access to the SSG related to the POI event through semantic transfer rule and storage strategy. Then, SPARSE identifies all suspicious flow paths (SFPs) related to the POI event from the SSG, quantifies the influence of each path to filter irrelevant events. Our evaluation on a real large-scale attack dataset shows that SPARSE can generate a critical component graph (~ 113 edges) in 1.6 seconds, which is 2014 X smaller than the backtracking graph (~ 227,589 edges). SPARSE is 25 X more effective than other state-of-the-art techniques in filtering irrelevant edges.

SAGE: Intrusion Alert-driven Attack Graph Extractor

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Forecasting Attacker Actions using Alert-driven Attack Graphs

Discovering Attack Scenarios Via Intrusion Alert Correlation Using Graph Convolutional Networks

Critical Path Prioritization Dashboard for Alert-driven Attack Graphs

Generating Network Attack Graphs for Security Alert Correlation

Building Network Attack Graph for Alert Causal Correlation

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

Graph-based Solutions with Residuals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms

An Automated Alert Cross-Verification System with Graph Neural Networks for IDS Events

A Graph Learning Approach with Audit Records for Advanced Attack Investigation

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

Robust Attack Graph Generation

Comprehensive analysis of real-time alerts with attack strategy graphs

A Data Mining Approach to Generating Network Attack Graph for Intrusion Prediction

SAGE: Stealthy Attack GEneration for Cyber-Physical Systems

SAGA: Synthetic Audit Log Generation for APT Campaigns

An Approach for Attack Scenario Construction Based on Dynamic Attack Path Graph.

ADSAGE: Anomaly Detection in Sequences of Attributed Graph Edges applied to insider threat detection at fine-grained level

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.