Abstract:Considering the stealthiness and persistence of Advanced Persistent Threats (APTs), system audit logs are leveraged in recent studies to construct system entity interaction provenance graphs to unveil threats in a host. Rule-based provenance graph APT detection approaches require elaborate rules and cannot detect unknown attacks, and existing learning-based approaches are limited by the lack of available APT attack samples or generally only perform graph-level anomaly detection, which requires lots of manual efforts to locate attack entities. This paper proposes an APT-exploited process detection approach called ThreatSniffer, which constructs the benign provenance graph from attack-free audit logs, fits normal system entity interactions and then detects APT-exploited processes by predicting the rationality of entity interactions. Firstly, ThreatSniffer understands system entities in terms of their file paths, interaction sequences, and the number distribution of interaction types and uses the multi-head self-attention mechanism to fuse these semantics. Then, based on the insight that APT-exploited processes interact with system entities they should not invoke, ThreatSniffer performs negative sampling on the benign provenance graph to generate non-existent edges, thus characterizing irrational entity interactions without requiring APT attack samples. At last, it employs a heterogeneous graph neural network as the interaction prediction model to aggregate the contextual information of entity interactions, and locate processes exploited by attackers, thereby achieving fine-grained APT detection. Evaluation results demonstrate that anomaly-based detection enables ThreatSniffer to identify all attack activities. Compared to the node-level APT detection method APT-KGL, ThreatSniffer achieves a 6.1% precision improvement because of its comprehensive understanding of entity semantics.

AISLE: Self-supervised Representation Learning for the Investigation of Advanced Persistent Threat

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

A novel approach for APT attack detection based on feature intelligent extraction and representation learning

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

Slot: Provenance-Driven APT Detection through Graph Reinforcement Learning

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data

A Federated Learning Approach for Multi-stage Threat Analysis in Advanced Persistent Threat Campaigns

Combating Advanced Persistent Threats: Challenges and Solutions

ATLAS: A Sequence-based Learning Approach for Attack Investigation

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

ALEAP: Attention-based LSTM with Event Embedding for Attack Projection

Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

Prov2vec: Learning Provenance Graph Representation for Unsupervised APT Detection