Abstract:Considering the stealthiness and persistence of Advanced Persistent Threats (APTs), system audit logs are leveraged in recent studies to construct system entity interaction provenance graphs to unveil threats in a host. Rule-based provenance graph APT detection approaches require elaborate rules and cannot detect unknown attacks, and existing learning-based approaches are limited by the lack of available APT attack samples or generally only perform graph-level anomaly detection, which requires lots of manual efforts to locate attack entities. This paper proposes an APT-exploited process detection approach called ThreatSniffer, which constructs the benign provenance graph from attack-free audit logs, fits normal system entity interactions and then detects APT-exploited processes by predicting the rationality of entity interactions. Firstly, ThreatSniffer understands system entities in terms of their file paths, interaction sequences, and the number distribution of interaction types and uses the multi-head self-attention mechanism to fuse these semantics. Then, based on the insight that APT-exploited processes interact with system entities they should not invoke, ThreatSniffer performs negative sampling on the benign provenance graph to generate non-existent edges, thus characterizing irrational entity interactions without requiring APT attack samples. At last, it employs a heterogeneous graph neural network as the interaction prediction model to aggregate the contextual information of entity interactions, and locate processes exploited by attackers, thereby achieving fine-grained APT detection. Evaluation results demonstrate that anomaly-based detection enables ThreatSniffer to identify all attack activities. Compared to the node-level APT detection method APT-KGL, ThreatSniffer achieves a 6.1% precision improvement because of its comprehensive understanding of entity semantics.

Needle in a Haystack: Attack Detection from Large-Scale System Audit.

ATLAS: A Sequence-based Learning Approach for Attack Investigation

Combating Advanced Persistent Threats: Challenges and Solutions

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

DISTDET: A Cost-Effective Distributed Cyber Threat Detection System

A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

TapTree: Process-Tree Based Host Behavior Modeling and Threat Detection Framework via Sequential Pattern Mining

ProPatrol: Attack Investigation via Extracted High-Level Tasks

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

Bon-APT: Detection, Attribution, and Explainability of APT Malware Using Temporal Segmentation of API Calls

A novel approach for APT attack detection based on an advanced computing