Advanced Persistent Threat Attacks Research Articles

A Game-Theoretic Method for Defending Against Advanced Persistent Threats in Cyber Systems

Advanced persistent threats (APTs) are one of today’s major threats to cyber security. Highly determined attackers along with novel and evasive exfiltration techniques mean APT attacks elude most intrusion detection and prevention systems. The result has been significant losses for governments, organizations, and commercial entities. Intriguingly, despite greater efforts to defend against APTs in recent times, frequent upgrades in defense strategies are not leading to increased security and protection. In this paper, we demonstrate this phenomenon in an appropriately designed APT rivalry game that captures the interactions between attackers and defenders. What is shown is that the defender’s strategy adjustments actually leave useful information for the attackers, and thus intelligent and rational attackers can improve themselves by analyzing this information. Hence, a critical part of one’s defense strategy must be finding a suitable time to adjust one’s strategy to ensure attackers learn the least possible information. Another challenge for defenders is determining how to make the best use of one’s resources to achieve a satisfactory defense level. In support of these efforts, we figured out the optimal timings of a player’s strategy adjustment in terms of information leakage, which form a family of Nash equilibria. Moreover, two learning mechanisms are proposed to help defenders find an appropriate defense level and allocate their resources reasonably. One is based on adversarial bandits, and the other is based on deep reinforcement learning. Experimental simulations show the rationales behind the game and the optimality of the equilibria. The results also demonstrate that players indeed have the ability to improve themselves by learning from past experiences, which shows the necessity of specifying optimal strategy adjustment timings when defending against APTs.

DeepAG: Attack Graph Construction and Threats Prediction With Bi-Directional Deep Learning

The complicated multi-step attacks, such as Advanced Persistent Threats (APTs), have brought considerable threats to cybersecurity because they are naturally varied and complex. Therefore, studying the strategies of adversaries and making predictions are still significant challenges for attack prevention. To address these problems, we propose <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> , a framework utilizing system logs to detect threats and predict the attack paths. <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> leverages transformer models to novelly detect APT attack sequences by modeling semantic information of system logs. On the other hand, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> utilizes Long Short-Term Memory (LSTM) network to propose bi-directional prediction for attack paths, which achieves higher performance than traditional BiLSTM. In addition, with previously detected attack sequences and predicted paths, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> constructs the attack graphs that attackers may follow to compromise the network. Furthermore, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> offers the mechanisms of Out-Of-Vocabulary (OOV) word processor and online update respectively to adapt new attack patterns that show up during detection and prediction stages. The experiments on open-source data sets show that more than 99% of over 15000 sequences can be detected accurately by <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> . Moreover, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAG</monospace> can improve the baseline by 11.166% of accuracy in terms of prediction.

Development of a method for ensuring confidentiality and authenticity in wireless channels

The object of the research is the development of a method for ensuring the authenticity and integrity of data in wireless channels based on post-quantum cryptosystems. The development of modern digital technologies ensures the transition to smart technologies and the formation of Next Generation Networks. The formation of smart technologies, as a rule, uses wireless communication channel standards IEEE 802.11X, IEEE 802.15.4, IEEE 802.16, which use only authentication protocols and privacy mechanisms, which are formed on symmetric algorithms. In the conditions of the post-quantum period (the advent of a full-scale quantum computer), the stability of such algorithms is questioned. Such systems, as a rule, are formed on the basis of the synthesis of socio-cyber-physical systems and cloud technologies, which simplifies the conduct of Advanced Persistent Threat attacks, both on the internal circuit of execution systems and on external control systems. The creation of multi-circuit information protection systems allows for an objective assessment of the current state of the system as a whole and the formation of preventive measures to counter cyber threats. The proposed method of providing basic security services: confidentiality, integrity and authenticity based on crypto-code constructions takes into account the level of secrecy of information transmitted over wireless channels and/or stored in databases of socio-cyber-physical systems. The use of post-quantum algorithms – McEliece/Niederreiter crypto-code constructions on elliptic/modified elliptic/lossy/Low-density parity-check code provides the necessary level of stability in the post-quantum cryptoperiod (crypto-stability at the level of 1025–1035 group operations), speed and probability of information (Рerr not lower than 10-9–10-12). The proposed method of information exchange using wireless communication channels ensures their practical implementation on resource-limited devices (creating of CCC on the GF field (24–26).

Performance evaluation of a fast and efficient intrusion detection framework for advanced persistent threat-based cyberattacks

After the COVID-19 pandemic, cyberattacks are increasing as non-face-to-face environments such as telecommuting and telemedicine proliferate. Cyberattackers exploit vulnerabilities in remote systems and endpoint devices in major enterprises and infrastructures. To counter these attacks, fast detection and response are essential because advanced persistent threat (APT) attacks intelligently infiltrate endpoint devices for long periods and spread to large-scale environments. However, because conventional security systems are signature-based, fast detection of APT attacks is challenging, and it is difficult to respond flexibly to the environment. In this study, we propose an APT fast detection and response technique using open-source tools that improves the efficiency of existing endpoint information protection systems and swiftly detects the APT attack process. Performance test results based on realistic scenarios using the open-source APT attack library and MITER ATT&CK indicated that fast detection was possible with higher accuracy for the early stages of APT attacks in scenarios where endpoint attack detectors are interworking environments.

Defense scheme against advanced persistent threats in mobile fog computing security

In mobile fog computing (MFC), data processing and applications are concentrated in devices at the network’s edge. This means that data can be processed in local intelligent devices without being sent to the cloud for execution, bringing great convenience to end-users. Fog computing is a semi-virtualised service computing architecture model between cloud computing and personal computing. However, its virtualized environment is vulnerable to advanced persistent threats (APT). In this paper, we propose an APT defense scheme based on MFC’s Double Q-learning (DQL) algorithm. First, we apply prospect theory (PT) to build a static subjective game model between APT attackers and legitimate users. In addition, a dynamic game scheme based on DQL is proposed against APT attacks. Finally, we compare our proposed method with the existing methods, i.e., the Q-learning algorithm, Sarsa algorithm and Greedy algorithm. The experimental results show that the proposed method can effectively suppress the attack motivation of APT attackers, improve the utility of legitimate users, and protect the security of the fog computing environment.

Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Despite its technological benefits, the Internet of Things (IoT) has cyber weaknesses due to vulnerabilities in the wireless medium. Machine Larning (ML)-based methods are widely used against cyber threats in IoT networks with promising performance. An Advanced Persistent Threat (APT) is prominent for cybercriminals to compromise networks, and it is crucial to long-term and harmful characteristics. However, it is difficult to apply ML-based approaches to identify APT attacks to obtain a promising detection performance due to an extremely small percentage among normal traffic. There are limited surveys that fully investigate APT attacks in IoT networks due to the lack of public datasets with all types of APT attacks. It is worth bridging the state of the art in network attack detection with APT attack detection in a comprehensive review article. This survey article reviews the security challenges in IoT networks and presents well-known attacks, APT attacks, and threat models in IoT systems. Meanwhile, signature-based, anomaly-based, and hybrid intrusion detection systems are summarized for IoT networks. The article highlights statistical insights regarding frequently applied ML-based methods against network intrusion. Finally, open issues and challenges for common network intrusion and APT attacks are presented for future research.

A Hybrid Intelligent Approach to Attribute Advanced Persistent Threat Organization Using PSO-MSVM Algorithm

In recent years, extensive research has been conducted in Advanced Persistent Threat (APT) attack defence. However, most existing defence solutions can only identify and temporarily disrupt cyber attacks, seeking to deny the threat from the intranet, it’s difficult to defence against APT attacks. Attributing the APT organization is an excellent complement to the existing defence solutions, which not only can expose the attacker’s true identity, but also provide evidence to bring the attacker to justice. However, research on attributing APT Organization is still few, poses complex tasks because APT attacks are highly targeted, stealthy, persistent and organized. To answer thie question, we propose a Particle Swarm Optimization Multiclass Support Vector Machine (PSO-MSVM) approach to identify the organization behind complex APT attacks automatically. Firstly, we have collected a large amount of data on the traces of APT attack tools executed in the sandbox, and selected data closely related to APT organizations to construct the feature set. Secondly, based on the strategy of keeping the personal best (pbest) and global best (gbest) particles in the particle swarm algorithm away from the adaptation values generated by the misclassification information as they move, the particle positions are updated frequently to eventually obtain the optimal parameters (i.e., penalty parameter ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${C}$ </tex-math></inline-formula> ) and sigma parameter ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\sigma $ </tex-math></inline-formula> )) for MSVM, thus enabling the MSVM technique to accurately identify APT organizations. The results obtained from the PSO-MSVM approach showed the superiority of this technique in three different measures of accuracy, precision and F1,compared with other six classical methods.

Advanced Persistent Threat intelligent profiling technique: A survey

With the boom in Internet and information technology, cyber-attacks are becoming more frequent and sophisticated, especially Advanced Persistent Threat (APT) attacks. Unlike traditional attacks, APT attacks are more targeted, stealthy, and adversarial, rendering it challenging to manually analyze threat behaviors for APT detection, attribution, and response. Therefore, the research community has focused on intelligent defense methods. Intelligent threat profiling is dedicated to analyzing APT attacks and improving defense capability with Knowledge Graph and Deep Learning methods. With this insight, this paper provides the first systematic review of intelligent threat profiling techniques for APT attacks, covering three aspects: data, methods, and applications. The contents include data processing techniques, threat modeling, representation, reasoning methods, etc. Furthermore, this paper summarizes the latest research in applications, proposes the research framework and technical architecture, and provides insights into future research trends. This paper contributes to recognizing the advantages and challenges of intelligent threat profiling. It paves the way for integrating knowledge graphs and deep learning to achieve intelligent security.

New approach for APT malware detection on the workstation based on process profile

The Advanced Persistent Threat (APT) attack is a form of dangerous, intentionally and clearly targeted attack. Currently, the APT attack trend is through the end-users and then escalating privileges in the system by spreading malware which is widely used by attackers. Therefore, the problem of early detection and warning of the APT attack malware on workstations is urgent. In this paper, we propose a new approach to APT malware detection on workstations based on the technique of analyzing and evaluating process profiles. The characteristics and principles of our proposed method are as follows: Firstly, processes are collected and aggregated into process profiles of APT malware; Secondly, these process profiles are used by Graph2Vec graph analysis algorithm to extract the characteristics of the process profile. Finally, in order to conclude about the sign of malicious APT, this paper proposes to use Long short-term memory (LSTM) and bidirectional LSTM (BiLSTM) algorithm. With the proposed approach in the paper, we have not only succeeded in building and synthesizing APT malware behavior on Workstations as a basis to improve the efficiency of predicting APT malware, but also have opened up a new approach to the task of synthesizing and analyzing anomalous behavior of malware.

Sequence feature extraction-based APT attack detection method with provenance graphs

Advanced persistent threat (APT) in real scenes, especially in industrial scenes, is complex and long term, but the current methods cannot effectively extract the long term relationship in the attack. An attack detection method with provenance graphs, called SeqNet, is proposed. SeqNet uses sequence feature extraction to detect APT attacks. In SeqNet, the provenance graph sequence describing the running state of the system is transformed into the feature sequence first, and then the gate recurrent unit (GRU) model is used to extract the feature of the system. The encoder-decoder model with the local attention mechanism is used to train the GRU model. Finally, the K-means clustering method is used to model the normal behavior of the system. In this study, experiments are carried out on five public datasets, such as StreamSpot, wget, shellshock, ClearScope, and CADETS, compared with the state-of-the-art methods. The method used here achieves similar or improved results on all five datasets. Experimental results show that the proposed method can detect real-life APT scenarios.

Understanding Advanced Persistent Threats

Advanced Persistent Threats (APTs) are a new type of threat that has piqued the interest of experts, particularly in the industrial security industry. APTs are cyber-attacks carried out by skilled and well-resourced adversaries who target specific information in high-profile organizations and governments, usually as part of a multi-step operation. The academic community has largely ignored the specifics of these threats, and as a result, an objective solution to the APT problem is absent. In terms of cybercrime activity, Africa has been one of the fastest rising regions. The continent is also a major source of cyberattacks on the rest of the world. A number of initiatives, however, have been implemented to mitigate cyber-threats and strengthen cybersecurity across the continent. The results of a complete study on APT are presented in this paper, which characterizes its differentiating traits and attack model while also assessing strategies often used in APT attacks. We also list various non-traditional countermeasures that can aid in the mitigation of APTs, highlighting future research prospects. Keywords : Advanced Persistent Threat, APT(s), Sophisticated Attacks, Cyber Security, Africa BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security &amp; Forensics. Open Access. Distributed Free Citation: Akuffo-Badoo Erastus B. (2022). Understanding Advanced Persistent Threats . SMART-IEEE-Creative Research Publications Book Chapter Series on Research Nexus in IT, Law, Cyber Security &amp; Forensics. Pp 15-22. www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P3

A novel intelligent cognitive computing-based APT malware detection for Endpoint systems

Detecting and warning Advanced Persistent Threat (APT) malware in Endpoint is essential because the current trend of APT attacker groups is to find ways to spread malware to users and then escalate privileges in the system. In this study, to improve the ability to detect APT malware on Endpoint machines, we propose a novel intelligent cognitive calculation method based on a model combining graph embeddings and Attention using processes generated by executable files. The proposed intelligent cognitive computation method performs 3 main tasks: i) extracting behaviors of processes; ii) aggregating the malware behaviors based on the processes; iii) detecting APT malware based on behavior analysis. To carry out the task (i), we propose to use several data mining techniques: extracting processes from Event IDs in the operating system kernel; extracting abnormal behaviors of processes. For task (ii), a graph embedding (GE) model based on the Graph Convolutional Networks (GCN) network is proposed to be used. For task (iii), based on the results of task (ii), the paper proposes to use a combination of the Convolutional Neural Network (CNN) network and Attention network (called CNN-Attention). The novelty and originality of this study is an intelligent cognitive computation method based on the use, combination, and synchronization of many different data mining techniques to compute, extract, and represent relationships and correlations among APT malware behaviors from processes. Based on this new intelligent cognitive computation method, many meaningful anomalous features and behaviors of APT malware have been synthesized and extracted. The proposals related to data mining methods to extract malware’s features and the list of malware’s behaviors provided in this paper are new information that has not been published in previous studies. In the experimental section, to demonstrate the effectiveness of the proposed method in detecting APT malware, the study has compared and evaluated it with other approaches. Experimental results in the paper have shown the outstanding efficiency of the proposed method when ensuring all metrics from 96.6% or more (that are 2% to 6% higher than other approaches). Experimental results in the paper have proven that our proposed method not only has scientifically significant but also has practical meaning because the method has helped to improve the efficiency of analyzing and detecting APT malware on Endpoint devices. In addition, this research result also has opened up a new approach for the task of detecting other anomalies on the Endpoint such as malware, unauthorized intrusion, insider, etc.

A novel approach for detecting advanced persistent threats

Cyber security has been drawing massive attention in recent years due to human reliance on new technology, and systems. Therefore, securing these systems against cyber-attacks has become an essential task nowadays. The advanced persistent threat is one of the most sophisticated cyber-attacks in which malicious actors gain unauthorized access to a network and remain undiscovered for a lengthy period of time. The number of recorded advanced persistent threat attacks and threats to organizations intensifies. One method used in detecting advanced persistent threat attacks is machine learning. However, this method has not been covered in many previous kinds of research due to the lack of datasets covering an entire advanced persistent threat attack lifecycle. Thus, this paper aims to build a new dataset that covers the complete life cycle of an advanced persistent threat attack to detect them in different stages such as normal, reconnaissance, initial compromise, lateral movement, and data exfiltration activities. The newly collected dataset is based on advanced persistent threat attacks using tactics, techniques, procedures, and indicators of compromise. Then, it is applied to a proposed machine learning model employing eXtreme gradient boosting and analysis of variance feature selection method. The model was compared to other traditional classifiers: random forest, decision tree, and K-nearest neighbor. Based on the accuracy score of the proposed model 99.89% using only 12 features, it proved to be more powerful and efficient than the other classifiers in detecting advanced persistent threat attacks. The dataset used in this research is newly built based on advanced persistent threat attack behaviors, which will aid organizations in detecting advanced persistent threat attack activity efficiently. The experimental evaluation proved that the proposed method effectively detects advanced persistent threat attacks at different stages.

APT-Attack Detection Based on Multi-Stage Autoencoders

In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector.

Phishing and Advanced Persistent Threats

The paper addresses one of the techniques mor used by Advanced Persistent Threats attacks, phishing. The paper demonstrates the complexity of the technique, explains how attacks can be carried out, and presents defense techniques, and strategies against phishing attacks. The article also presents a summary description of what an Advanced Persistent Threat attack is. This description characterizes this type of attack.

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework.

During the last several years, the Internet of Things (IoT), fog computing, computer security, and cyber-attacks have all grown rapidly on a large scale. Examples of IoT include mobile devices such as tablets and smartphones. Attacks can take place that impact the confidentiality, integrity, and availability (CIA) of the information. One attack that occurs is Advanced Persistent Threat (APT). Attackers can manipulate a device’s behavior, applications, and services. Such manipulations lead to signification of a deviation from a known behavioral baseline for smartphones. In this study, the authors present a Systematic Literature Review (SLR) to provide a survey of the existing literature on APT defense mechanisms, find research gaps, and recommend future directions. The scope of this SLR covers a detailed analysis of most cybersecurity defense mechanisms and cutting-edge solutions. In this research, 112 papers published from 2011 until 2022 were analyzed. This review has explored different approaches used in cybersecurity and their effectiveness in defending against APT attacks. In a conclusion, we recommended a Situational Awareness (SA) model known as Observe–Orient–Decide–Act (OODA) to provide a comprehensive solution to monitor the device’s behavior for APT mitigation.

Two statistical traffic features for certain APT group identification

Advanced Persistent Threat (APT) attack, which refers to the continuous and effective attack activities carried out by a group on a specific object, has become the major threats of highly protected networks. The attack traffics generated by a certain APT group, have a high similar distribution, especially in the command and control (C&C) stage. This paper analyzes the DNS and TCP traffic of a certain APT group’s attack, and constructs two new features, C2Load_fluct (response packet load fluctuation) and Bad_rate (bad packet rate), which can be used to identify APT group. Experimental results show that the F1-score can reach above 0.98 and 0.94 respectively on the two datasets, which proves that the two new features are effective for APT group identification.

Many phish in the : A coexisting-choice-criteria model of security behavior.

Normative decision theory proves inadequate for modeling human responses to the social-engineering campaigns of advanced persistent threat (APT) attacks. Behavioral decision theory fares better, but still falls short of capturing social-engineering attack vectors which operate through emotions and peripheral-route persuasion. We introduce a generalized decision theory, under which any decision will be made according to one of multiple coexisting choice criteria. We denote the set of possible choice criteria by . Thus, the proposed model reduces to conventional Expected Utility theory when , while Dual-Process (thinking fast vs. thinking slow) decision making corresponds to a model with . We consider a more general case with , which necessitates careful consideration of how, for a particular choice-task instance, one criterion comes to prevail over others. We operationalize this with a probability distribution that is conditional upon traits of the decisionmaker as well as upon the context and the framing of choice options. Whereas existing signal detection theory (SDT) models of phishing detection commingle the different peripheral-route persuasion pathways, in the present descriptive generalization the different pathways are explicitly identified and represented. A number of implications follow immediately from this formulation, ranging from the conditional nature of security-breach risk to delineation of the prerequisites for valid tests of security training. Moreover, the model explains the "stepping-stone" penetration pattern of APT attacks, which has confounded modeling approaches based on normativerationality.

Multi-receiver signcryption scheme with multiple key generation centers through public channel in edge computing

The emerging edge computing technology for the Internet of Things has been playing an important role in our daily life. It is promising to utilize a multi-receiver signcryption scheme to protect the transmission data when an edge device broadcasts its sensing data to many different end devices at a time. There are several things to consider when we design a signcryption scheme. First existing schemes need to maintain a secure channel to generate the user private key, which may increase economic costs. Second the system private key of those schemes is kept secret by a single key generation center (KGC), and the single point of failure of KGC may compromise the whole system. For this, we propose a multi-receiver multi-message signcryption scheme without the secure channel. Firstly the scheme allows KGC to send secrets through the public channel, which reduces maintenance costs. Secondly, to eliminate the single point of failure, the scheme utilizes multiple KGCs to manage the system private key, and updates the secret of each KGC periodically to resist advanced persistent threat attacks. We demonstrate that the proposed scheme can achieve expected security properties. Performance analysis shows that it is with shorter ciphertext length and higher efficiency.

Comparison of the Host Based Intrusion Detection Systems and Network Based Intrusion Detection Systems

Recently, Advanced Persistent Threat (APT) has emerged as sophisticated and tailor-made attacks. APTs pose threats mainly targeting institutions such as military, defense and security infrastructure, high profile companies and governments etc. Particularly as a counter measure for APT attacks done by hactivists and cyber warriors and cyber terrorists over government institutions and e-government applications intrusion detection mechanisms are of crucial importance in effective defense. In this study, Intrusion detection and prevention systems have been studied in detail after being referred to the tasks and abilities of the intrusion detection systems that are at the core of the computer security technology presented today in order to meet the increasing need for information and network security. This paper’s aim is the specifying the differences between Host Based Intrusion Detection Systems (HIDS) and Network Based Intrusion Detection Systems (NIDS) and compares the tools which are using HIDS and NIDS. It is asserted that in order to have a better assurance for APT attacks there should be set up a Hybrid IDS approach covering both networks and hosts using both signature and behavioral detection mechanism based on machine learning.