Abstract:Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT\&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

A Review of APT Attack Detection Methods and Defense Strategies.

A Research on Architecture of APT Attack Detection and Countering Technology

Threats and Opportunities with AI-based Cyber Security Intrusion Detection: A Review

A Model of APT Attack Defense Based on Cyber Threat Detection

Advanced Persistent Threat intelligent profiling technique: A survey

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

An Intelligence-Driven Security-Aware Defense Mechanism for Advanced Persistent Threats.

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey

Artificial intelligence algorithms for cyberspace security applications: a technological and status review

Moving Target Defense Techniques: A Survey

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Dynamic defenses in cyber security: Techniques, methods and challenges

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

A comprehensive review study of cyber-attacks and cyber security; Emerging trends and recent developments

Review of Artificial Intelligence Adversarial Attack and Defense Technologies

A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model

Defense Against Advanced Persistent Threat Through Data Backup and Recovery

Cyber Situation Comprehension For Iot Systems Based On Apt Alerts And Logs Correlation

Conventional Defense Technologies