Abstract:Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT\&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

RShield: A Refined Shield for Complex Multi-step Attack Detection Based on Temporal Graph Network

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Practical Cyber Attack Detection With Continuous Temporal Graph in Dynamic Network System

LogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis

Detecting Complex Multi-step Attacks with Explainable Graph Neural Network

<sc>Conan</sc>: A Practical Real-Time APT Detection System With High Accuracy and Efficiency

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Detecting Unknown Threat Based on Continuous-Time Dynamic Heterogeneous Graph Network

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

Dynamic Interactional And Cooperative Network For Shield Machine

An Unsupervised Two-Layer Multi-Step Network Attack Detector

NCShield: Securing Decentralized, Matrix Factorization-Based Network Coordinate Systems

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection

An alert correlating algorithm based on multi-step attack path graphs:MSACA

REAL-GUARD

LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection