Abstract:Abstract Advanced persistent threats (APTs) pose significant security-related challenges to organizations owing to their sophisticated and persistent nature, and are inimical to the confidentiality, integrity, and availability of organizational information and services. This study systematically reviews the literature on methods of detecting APTs by comprehensively surveying research in the area, identifying gaps in the relevant studies, and proposing directions for future work. The authors provide a detailed analysis of current methods of APT detection that are based on multi-stage attack-related behaviors. We adhered to the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines and conducted an extensive search of a variety of databases. A total of 45 studies, encompassing sources from both academia and the industry, were considered in the final analysis. The findings reveal that APTs have the capability to laterally propagate and achieve their objectives by identifying and exploiting existing systemic vulnerabilities. By identifying shortcomings in prevalent methods of APT detection, we propose integrating the multi-stage attack-related behaviors of APTs with the assessment of the presence of vulnerabilities in the network and their susceptibility to being exploited in order to improve the accuracy of their identification. Such an improved approach uses vulnerability scores and probability metrics to determine the probable sequence of targeted nodes, and visualizes the path of APT attacks. This technique of advanced detection enables the early identification of the most likely targets, which, in turn, allows for the implementation of proactive measures to prevent the network from being further compromised. The research here contributes to the literature by highlighting the importance of integrating multi-stage attack-related behaviors, vulnerability assessment, and techniques of visualization for APT detection to enhance the overall security of organizations.

Survey of Attack and Detection Based on the Full Life Cycle of APT

Advanced Persistent Threat intelligent profiling technique: A survey

Combating Advanced Persistent Threats: Challenges and Solutions

A Model of APT Attack Defense Based on Cyber Threat Detection

Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey

A systematic literature review on advanced persistent threat behaviors and its detection strategy

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

ATT&CK-based Advanced Persistent Threat attacks risk propagation assessment model for zero trust networks

Strategically-Motivated Advanced Persistent Threat: Definition, Process, Tactics and a Disinformation Model of Counterattack

LTRDetector: Exploring Long-Term Relationship for Advanced Persistent Threats Detection

Security evaluation of cyber networks under advanced persistent threats

TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Detecting Advanced Persistent Threat in Edge Computing via Federated Learning

A Comprehensive Survey of Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems

Detecting APT attacks using an attack intent-driven and sequence-based learning approach

A Game Theoretic Approach for Dynamic Information Flow Tracking to Detect Multi-Stage Advanced Persistent Threats

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model

Bon-APT: Detection, Attribution, and Explainability of APT Malware Using Temporal Segmentation of API Calls

ATLAS: A Sequence-based Learning Approach for Attack Investigation