Abstract:Advanced Persistent Threats (APT) are a type of sophisticated multistage cyber attack, and the defense against APT is challenging. Existing studies apply signature-based or behavior-based methods to analyze monitoring data to detect APT, but little research has been dedicated to the important problem of addressing APT detection with limited resources. In order to maintain the primary functionality of a system, the resources allocated for security purposes, for example logging and examining the behavior of a system, are usually constrained. Therefore, when facing multiple simultaneous powerful cyber attacks like APT, the allocation of limited security resources becomes critical. The research in this paper focuses on the threat model where multiple simultaneous APT attacks exist in the defender's system, but the defender does not have sufficient monitoring resources to check every running process. To capture the footprint of multistage activities including APT attacks and benign activities, this work leverages the provenance graph which is constructed based on dependencies of processes. Furthermore, this work studies the monitoring strategy to efficiently detect APT attacks from incomplete information of paths on the provenance graph, by considering both the "exploitation" effect and the "exploration" effect. The contributions of this work are two-fold. First, it extends the classic UCB algorithm in the domain of the multi-armed bandit problem to solve cyber security problems, and proposes to use the malevolence value of a path, which is generated by a novel LSTM neural network as the exploitation term. Second, the consideration of "exploration" is innovative in the detection of APT attacks with limited monitoring resources. The experimental results show that the use of the LSTM neural network is beneficial to enforce the exploitation effect as it satisfies the same property as the exploitation term in the classic UCB algorithm and that by using the proposed monitoring strategy, multiple simultaneous APT attacks are detected more efficiently than using the random strategy and the greedy strategy, regarding the time needed to detect same number of APT attacks.

MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

GHunter: A Fast Subgraph Matching Method for Threat Hunting.

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

APT-KGL: an Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

A Graph Learning Approach with Audit Records for Advanced Attack Investigation

Detect Advanced Persistent Threat In Graph-Level Using Competitive AutoEncoder.

TRACEGADGET: Detecting and Tracing Network Level Attack Through Federal Provenance Graph

TBDetector:Transformer-Based Detector for Advanced Persistent Threats with Provenance Graph

MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning

Detecting APT-Exploited Processes through Semantic Fusion and Interaction Prediction

Sequence Feature Extraction-Based APT Attack Detection Method with Provenance Graphs

Needle in a Haystack: Attack Detection from Large-Scale System Audit.

AISLE: Self-supervised Representation Learning for the Investigation of Advanced Persistent Threat

A Hierarchical Approach for Advanced Persistent Threat Detection with Attention-Based Graph Neural Networks

TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning

Strategic Monitoring for Efficient Detection of Simultaneous APT Attacks with Limited Resources

Combating Advanced Persistent Threats: Challenges and Solutions

Machine Learning for APT Detection

Bon-APT: Detection, Attribution, and Explainability of APT Malware Using Temporal Segmentation of API Calls

ATLAS: A Sequence-based Learning Approach for Attack Investigation

A Causal Graph-Based Approach for APT Predictive Analytics