Abstract:Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT\&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

ProPatrol: Attack Investigation via Extracted High-Level Tasks

Needle in a Haystack: Attack Detection from Large-Scale System Audit.

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

ATLAS: A Sequence-based Learning Approach for Attack Investigation

A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security

A Graph Learning Approach with Audit Records for Advanced Attack Investigation

DISTDET: A Cost-Effective Distributed Cyber Threat Detection System

AttackMiner: A Graph Neural Network Based Approach for Attack Detection from Audit Logs

Probabilistically Inferring Attack Ramifications Using Temporal Dependence Network

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Zebra: Deeply Integrating System-Level Provenance Search and Tracking for Efficient Attack Investigation

Lens On The Endpoint: Hunting For Malicious Software Through Endpoint Data Analysis

This is Why We Can't Cache Nice Things: Lightning-Fast Threat Hunting using Suspicion-Based Hierarchical Storage

<i>APTrace</i>: A Responsive System for Agile Enterprise Level Causality Analysis

High Fidelity Data Reduction for Big Data Security Dependency Analyses.

Towards a Timely Causality Analysis for Enterprise Security.

How hard can it be? Quantifying MITRE attack campaigns with attack trees and cATM logic

SpecRep: Adversary Emulation Based on Attack Objective Specification in Heterogeneous Infrastructures

Time-Travel Investigation: Towards Building A Scalable Attack Detection Framework on Ethereum

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports