Abstract:Considering the stealthiness and persistence of Advanced Persistent Threats (APTs), system audit logs are leveraged in recent studies to construct system entity interaction provenance graphs to unveil threats in a host. Rule-based provenance graph APT detection approaches require elaborate rules and cannot detect unknown attacks, and existing learning-based approaches are limited by the lack of available APT attack samples or generally only perform graph-level anomaly detection, which requires lots of manual efforts to locate attack entities. This paper proposes an APT-exploited process detection approach called ThreatSniffer, which constructs the benign provenance graph from attack-free audit logs, fits normal system entity interactions and then detects APT-exploited processes by predicting the rationality of entity interactions. Firstly, ThreatSniffer understands system entities in terms of their file paths, interaction sequences, and the number distribution of interaction types and uses the multi-head self-attention mechanism to fuse these semantics. Then, based on the insight that APT-exploited processes interact with system entities they should not invoke, ThreatSniffer performs negative sampling on the benign provenance graph to generate non-existent edges, thus characterizing irrational entity interactions without requiring APT attack samples. At last, it employs a heterogeneous graph neural network as the interaction prediction model to aggregate the contextual information of entity interactions, and locate processes exploited by attackers, thereby achieving fine-grained APT detection. Evaluation results demonstrate that anomaly-based detection enables ThreatSniffer to identify all attack activities. Compared to the node-level APT detection method APT-KGL, ThreatSniffer achieves a 6.1% precision improvement because of its comprehensive understanding of entity semantics.

ThreatInsight: Innovating Early Threat Detection Through Threat-Intelligence-Driven Analysis and Attribution

Intelligent Threat Detection—AI-Driven Analysis of Honeypot Data to Counter Cyber Threats

Advanced Persistent Threat intelligent profiling technique: A survey

Enabling Efficient Cyber Threat Hunting with Cyber Threat Intelligence

A System for Efficiently Hunting for Cyber Threats in Computer Systems Using Threat Intelligence

AnyThreat: An Opportunistic Knowledge Discovery Approach to Insider Threat Detection

IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data

ThreatKG: An AI-Powered System for Automated Open-Source Cyber Threat Intelligence Gathering and Management

Towards Automated Threat Intelligence Fusion

Combating Advanced Persistent Threats: Challenges and Solutions

A Threat Hunting Framework for Industrial Control Systems

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

APTKG: Constructing Threat Intelligence Knowledge Graph from Open-Source APT Reports Based on Deep Learning

An AI-Powered Network Threat Detection System

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

Anteater: Advanced Persistent Threat Detection With Program Network Traffic Behavior

Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports

Threat Trekker: An Approach to Cyber Threat Hunting

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

A System for Automated Open-Source Threat Intelligence Gathering and Management