Poirot: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection

Abstract

The volatile, covert and slow multistage attack patterns of Advanced Persistent Threat (APT) present a tricky challenge of APT detection, which are vital for organisations to protect their critical assets. In this article, we aim to develop system that aggregates and uses existing systems’ alerts to detect APTs. In order to achieve this, we propose a causal correlation aided semantic analysis system, called <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Poirot</small> , for detecting the multi-stage threats over a long-time span from existing systems’ alerts. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Poirot</small> is capable of autonomously mining causality between anomalous events, which instructs us in reorganizing the original alerts and in constructing alert-chains. The system further exploits the Latent Dirichlet Allocation (LDA) to model the semantic context of the alert-chains. This LDA model facilitates us to carry out the semantic analysis for capturing the latent attack intent as well as for reconstructing the APT scenario. We use an alert dataset provided by a cyber security company to verify the proposed <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Poirot</small> in terms of the detection accuracy and the capability of attack scenario reconstruction. The experiment results are presented to show the achievable performance of the proposed semantic analysis based APT detection.