Abstract:The increasingly sophisticated Advanced Persistent Threat (APT) attacks have become a serious challenge for enterprise IT security. Attack causality analysis, which tracks multi-hop causal relationships between files and processes to diagnose attack provenances and consequences, is the first step towards understanding APT attacks and taking appropriate responses. Since attack causality analysis is a time-critical mission, it is essential to design causality tracking systems that extract useful attack information in a timely manner. However, prior work is limited in serving this need. Existing approaches have largely focused on pruning causal dependencies totally irrelevant to the attack, but fail to differentiate and prioritize abnormal events from numerous relevant, yet benign and complicated system operations, resulting in long investigation time and slow responses. To address this problem, we propose PRIOTRACKER, a backward and forward causality tracker that automatically prioritizes the investigation of abnormal causal dependencies in the tracking process. Specifically, to assess the priority of a system event, we consider its rareness and topological features in the causality graph. To distinguish unusual operations from normal system events, we quantify the rareness of each event by developing a reference model which records common routine activities in corporate computer systems. We implement PRIOTRACKER, in 20K lines of Java code, and a reference model builder in 10K lines of Java code. We evaluate our tool by deploying both systems in a real enterprise IT environment, where we collect 1TB of 2.5 billion OS events from 150 machines in one week. Experimental results show that PRIOTRACKER can capture attack traces that are missed by existing trackers and reduce the analysis time by up to two orders of magnitude.

UISCOPE: Accurate, Instrumentation-free, and Visible Attack Investigation for GUI Applications

TESEC: Accurate Server-side Attack Investigation for Web Applications

OWL: Understanding and Detecting Concurrency Attacks

OutletSpy

Zebra: Deeply Integrating System-Level Provenance Search and Tracking for Efficient Attack Investigation

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

<i>APTrace</i>: A Responsive System for Agile Enterprise Level Causality Analysis

Inferring UI States of Mobile Applications Through Power Side Channel Exploitation.

Discovering, quantifying, and displaying attacks

Visible Forensic Investigation for Android Applications by Using Attack Scenario Reconstruction.

SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and PHYsical

Owl Eyes: Spotting UI Display Issues via Visual Understanding

ICScope: Detecting and Measuring Vulnerable ICS Devices Exposed on the Internet.

Accurate and Efficient Exploit Capture and Classification

Towards a Timely Causality Analysis for Enterprise Security.

EthScope: A Transaction-centric Security Analytics Framework to Detect Malicious Smart Contracts on Ethereum.

A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security

ProPatrol: Attack Investigation via Extracted High-Level Tasks

A Preliminary Study on Sensitive Information Exposure Through Logging.