Abstract:Advanced Persistent Threats (APT) present the most sophisticated types of attacks to modern networks which have proved to be very challenging to address. Using sophisticated attack techniques, attackers remotely control infected machines and exfiltrate sensitive information from organizations and governments. Security products deployed by enterprise networks based on traditional defenses often fail at detecting APT infections because of the dynamic nature of the APT attack process. To overcome the current limitations of attack network dynamics faced in APT studies, an innovative APT attack detection model based on a semi-supervised learning approach and complex networks characteristics is proposed in this paper. The entire targeted network is modeled as a small-world network and the evolving APT-Attack Network (APT-AN) as a scale-free network. Finite state machines are employed to model the state transitions of the nodes in the time domain in order to characterize the state changes during the APT attack process. The effectiveness of the model is demonstrated by applying it to real-world data from a large-scale enterprise network consisting of 17,684 hosts from the Los Alamos security lab. The proposed approach analyzes efficiently the large-scale dataset to reveal APT attack characteristics between the command and control center and the victim hosts. The final result is a ranked list of suspicious hosts participating in APT attack activities. The average detection precision of three APT stage is 90.5% in our proposed APT detection framework. The results show that the model can effectively detect the suspicious hosts at different stages of the APT attack process.

An Overview of Advanced Persistent Threat Detection Based on Machine Learning

A Review of APT Attack Detection Methods and Defense Strategies.

A Survey on Advanced Persistent Threat Detection: A Unified Framework, Challenges, and Countermeasures

A spatial-temporal correlation based method for advanced persistent threat detection

Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine

Advanced Persistent Threat intelligent profiling technique: A survey

An Intelligence-Driven Security-Aware Defense Mechanism for Advanced Persistent Threats.

Detecting Advanced Persistent Threat in Edge Computing via Federated Learning

Machine Learning for APT Detection

An Intelligent Game Theory Framework for Detecting Advanced Persistent Threats

A Research on Architecture of APT Attack Detection and Countering Technology

A Model of APT Attack Defense Based on Cyber Threat Detection

An Advanced Persistent Threats Detection Method Based on Deep Reinforcement Learning

Survey of Attack and Detection Based on the Full Life Cycle of APT

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Exploring the Vulnerability in the Inference Phase of Advanced Persistent Threats

Advanced persistent threat detection based on characteristics of communications

A Network Gene-Based Framework for Detecting Advanced Persistent Threats

Modeling and Detection of the Multi-Stages of Advanced Persistent Threats Attacks Based on Semi-Supervised Learning and Complex Networks Characteristics

Defending Against the Advanced Persistent Threat: an Optimal Control Approach.

Predicting Advanced Persistent Threats for IoT Systems Based on Federated Learning.