A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching
Fuente:
arXiv
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866929568426754048 |
|---|---|
| author | Huang, Yi-Ting Guo, Ying-Ren Wong, Guo-Wei Chen, Meng Chang |
| author_facet | Huang, Yi-Ting Guo, Ying-Ren Wong, Guo-Wei Chen, Meng Chang |
| contents | As Advanced Persistent Threats (APTs) grow increasingly sophisticated, the demand for effective detection methods has intensified. This study addresses the challenge of identifying APT campaign attacks through system event logs. A cascading approach, name SFM, combines Technique hunting and APT campaign attribution. Our approach assumes that real-world system event logs contain a vast majority of normal events interspersed with few suspiciously malicious ones and that these logs are annotated with Techniques of MITRE ATT&CK framework for attack pattern recognition. Then, we attribute APT campaign attacks by aligning detected Techniques with known attack sequences to determine the most likely APT campaign. Evaluations on five real-world APT campaigns indicate that the proposed approach demonstrates reliable performance. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2410_22602 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching Huang, Yi-Ting Guo, Ying-Ren Wong, Guo-Wei Chen, Meng Chang Cryptography and Security As Advanced Persistent Threats (APTs) grow increasingly sophisticated, the demand for effective detection methods has intensified. This study addresses the challenge of identifying APT campaign attacks through system event logs. A cascading approach, name SFM, combines Technique hunting and APT campaign attribution. Our approach assumes that real-world system event logs contain a vast majority of normal events interspersed with few suspiciously malicious ones and that these logs are annotated with Techniques of MITRE ATT&CK framework for attack pattern recognition. Then, we attribute APT campaign attacks by aligning detected Techniques with known attack sequences to determine the most likely APT campaign. Evaluations on five real-world APT campaigns indicate that the proposed approach demonstrates reliable performance. |
| title | A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2410.22602 |