Abstract:The success of deep learning (DL) techniques has led to their adoption in many fields, including attack investigation, which aims to recover the whole attack story from logged system provenance by analyzing the causality of system objects and subjects. Existing DL-based techniques, e.g., state-of-the-art one ATLAS, follow the design of traditional forensics analysis pipelines. They train a DL model with labeled causal graphs during offline training to learn benign and malicious patterns. During attack investigation, they first convert the log data to causal graphs and leverage the trained DL model to determine if an entity is part of the whole attack chain or not. This design does not fully release the power of DL. Existing works like BERT have demonstrated the superiority of leveraging unsupervised pre-trained models, achieving state-of-the-art results without costly and error-prone data labeling. Prior DL-based attacks investigation has overlooked this opportunity. Moreover, generating and operating the graphs are time-consuming and not necessary. Based on our study, these operations take around 96% of the total analysis time, resulting in low efficiency. In addition, abstracting individual log entries to graph nodes and edges makes the analysis more coarse-grained, leading to inaccurate and unstable results. We argue that log texts provide the same information as causal graphs but are fine-grained and easier to analyze. This paper presents AIRTAG, a novel attack investigation system. It is powered by unsupervised learning with log texts. Instead of training on labeled graphs, AIRTAG leverages unsupervised learning to train a DL model on the log texts. Thus, we do not require the heavyweight and error-prone process of manually labeling logs. During the investigation, the DL model directly takes log files as inputs and predicts entities related to the attack. We evaluated AIRTAG on 19 scenarios, including single-host and multi-host attacks. Our results show the superior efficiency and effectiveness of AIRTAG compared to existing solutions. By removing graph generation and operations, AIRTAG is 2.5x faster than the state-of-the-art method, ATLAS, with 9.0% fewer false positives and 16.5% more true positives on average.

ATLAS: A Sequence-based Learning Approach for Attack Investigation

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

Detecting Apt Attacks Using an Extended Sequence-Based Learning Approach

ACTracker: A Fast and Efficient Attack Investigation Method Based on Event Causality

Constructing APT Attack Scenarios Based on Intrusion Kill Chain and Fuzzy Clustering

A Causal Graph-Based Approach for APT Predictive Analytics

Needle in a Haystack: Attack Detection from Large-Scale System Audit.

ATLASv2: ATLAS Attack Engagements, Version 2

AClog: Attack Chain Construction Based on Log Correlation.

CrptAC: Find the Attack Chain with Multiple Encrypted System Logs

Learning Attack Strategies Through Attack Sequence Mining Method

AIRTAG: Towards Automated Attack Investigation by Unsupervised Learning with Log Texts

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

A Distributed Framework for APT Attack Analysis

A Graph Learning Approach with Audit Records for Advanced Attack Investigation

A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching

A Temporal Correlation and Traffic Analysis Approach for APT Attacks Detection.

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

T-Trace: Constructing the APTs Provenance Graphs Through Multiple Syslogs Correlation

Machine Learning for APT Detection

A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security