Abstract:Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT\&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

Detecting Advanced Persistent Threat in Edge Computing via Federated Learning

A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns

XFedHunter: An Explainable Federated Learning Framework for Advanced Persistent Threat Detection in SDN

Predicting the APT for Cyber Situation Comprehension in 5G-Enabled IoT Scenarios Based on Differentially Private Federated Learning

Privacy-preserving Few-shot Traffic Detection against Advanced Persistent Threats via Federated Meta Learning

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Intrusion Detection using Federated Attention Neural Network for Edge Enabled Internet of Things

Advanced Persistent Threat Detection in Smart Grid Clouds Using Spatiotemporal Context-Aware Graph Embedding

A novel approach for APT attack detection based on feature intelligent extraction and representation learning

DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems

Privacy-Preserving Federated Learning-Based Intrusion Detection Technique for Cyber-Physical Systems

A Model of APT Attack Defense Based on Cyber Threat Detection

Fed-LSAE: Thwarting Poisoning Attacks against Federated Cyber Threat Detection System via Autoencoder-based Latent Space Inspection

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Federated transfer learning for attack detection for Internet of Medical Things

DISTDET: A Cost-Effective Distributed Cyber Threat Detection System

APT-Dt-KC: advanced persistent threat detection based on kill-chain model

A Novel Network Forensic Framework for Advanced Persistent Threat Attack Attribution Through Deep Learning

Explainable Intelligence-Driven Defense Mechanism against Advanced Persistent Threats: A Joint Edge Game and AI Approach