Advanced Persistent Threat Attacks Research Articles

Advanced Persistent Threat Group Correlation Analysis via Attack Behavior Patterns and Rough Sets

In recent years, advanced persistent threat (APT) attacks have become a significant network security threat due to their concealment and persistence. Correlation analysis of APT groups is vital for understanding the global network security landscape and accurately attributing threats. Current studies on threat attribution rely on experts or advanced technology to identify evidence linking attack incidents to known APT groups. However, there is a lack of research focused on automatically discovering potential correlations between APT groups. This paper proposes a method using attack behavior patterns and rough set theory to quantify APT group relevance. It extracts two types of features from threat intelligence: APT attack objects and behavior features. To address the issues of inconsistency and limitations in threat intelligence, this method uses rough set theory to model APT group behavior and designs a link prediction method to infer correlations among APT groups. Experimental results on publicly available APT analysis reports show a correlation precision of 90.90%. The similarity coefficient accurately reflects the correlation strength, validating the method’s efficacy and accuracy.

ConGraph: Advanced Persistent Threat Detection Method Based on Provenance Graph Combined with Process Context in Cyber-Physical System Environment

With the wide use of Cyber-Physical Systems (CPS) in many applications, targets of advanced persistent threats (APTs) have been extended to the IoT and industrial control systems. Provenance graph analysis based on system audit logs has become a promising way for APT detection and investigation. However, we cannot afford to ignore that existing provenance-based APT detection systems lack the process–context information at system runtime, which seriously limits detection performance. In this paper, we proposed ConGraph, an approach for detecting APT attacks using provenance graphs combined with process context; we presented a module for collecting process context to detect APT attacks. This module collects file access behavior, network access behavior, and interactive relationship features of processes to enrich semantic information of the provenance graph. It was the first time that the provenance graph was combined with multiple process–context information to improve the detection performance of APT attacks. ConGraph extracts process activity features from the provenance graphs and submits the features to a CNN-BiLSTM model to detect underlying APT activities. Compared to some state-of-the-art models, our model raised the average precision rate, recall rate, and F-1 score by 13.12%, 25.61%, and 24.28%, respectively.

Graph neural network‐based attack prediction for communication‐based train control systems

AbstractThe Advanced Persistent Threats (APTs) have emerged as one of the key security challenges to industrial control systems. APTs are complex multi‐step attacks, and they are naturally diverse and complex. Therefore, it is important to comprehend the behaviour of APT attackers and anticipate the upcoming attack actions. GNN‐AP is proposed, a framework utilising an alert log to predict potential attack targets. Firstly, GNN‐AP uses causality to eliminate confounding elements from the alert dataset and then uses an encoder‐decoder model to reconstruct an attack scenario graph. Based on the chronological characteristics of APT attacks, GNN‐AP identifies APT attack sequences from attack scenario graphs and integrates these attack sequences with communication‐based train control (CBTC) devices topology information to construct an Attack‐Target Graph. Based on the attack‐target graph, a graph neural network approach is used to identify the attack intent and transforms the attack prediction problem into a link prediction problem that predicts the connected edges of the attack and target nodes. The simulation results obtained using DARPA data show that the proposed method can improve the comparison methods by 4% of accuracy in terms of prediction. Furthermore, the method was applied to the CBTC system dataset with a prediction accuracy of 88%, demonstrating the efficacy of the proposed method for industrial control systems.

APT Attack Detection of a New Power System based on DPI-transformer

Introduction: In recent years, the frequent occurrence of network security attacks in the power field has brought huge risks to the production, transmission, and supply of power systems, and Advanced Persistent Threat (APT) is a covert advanced network security attack, which has become one of the network security risks that cannot be ignored in the construction of new power systems. Objective: This study aims to resist the increasing risk of APT attacks in the construction of new power systems, this paper proposes an attack detection model based on Deep Packet Inspection (DPI) and Transformer. Methods: Firstly, we extracted 606 traffic characteristics from the original traffic data through the extended CIC Flowmeter and used them all to train the Transformer network. Then, we used the DPI-Transformer model and traffic labels to perform feature analysis on the traffic data and finally obtained the APT-Score. If the APT-Score is greater than the threshold, the alarm module is triggered. Results: By analyzing the headers and payloads of the network traffic in the APT-2020 dataset, the experimental results show that the detection accuracy of APT attacks by the DPI-Transformer detection model is significantly higher than that of the current mainstream APT attack detection algorithms. Conclusion: Combined with the characteristics of the new power system and APT attacks, this paper proposes an attack detection model DPI-Transformer, which proves that the model has greatly improved the detection accuracy.

A Generation Method of New Power System APT Attack Graph Based on DQN

Background: The new power system is more vulnerable to Advanced Persistent Threat (APT) than the traditional power system. Objective: This study aims to grasp the intent of the APT attack better; a new generation method of power system APT attack graph based on DQN is proposed. Methods: First, the network topology of the new power system was extracted by Nessus scanning as the model input. Secondly, the agent in DQN was trained for multiple rounds. Starting from the set initial state, the agent selected the action with the highest Q value to act on the system in each round, and then the system entered the next state. Then the Q network function value was updated according to the obtained system feedback value until the target state appeared. Results: After multiple rounds of training agents, multiple APT attack paths were finally obtained, thus an APT attack graph can be generated. Conclusion: The experimental results showed that the efficiency of generating an APT attack graph based on the DQN method is obviously superior to the existing methods for the large-scale industrial control system, such as the new power system.

APT-KGL: An Intelligent APT Detection System Based on Threat Knowledge and Heterogeneous Provenance Graph Learning

APTs (Advanced Persistent Threats) have caused serious security threats worldwide. Most existing APT detection systems are implemented based on sophisticated forensic analysis rules. However, the design of these rules requires in-depth domain knowledge and the rules lack generalization ability. On the other hand, deep learning technique could automatically create detection model from training samples with little domain knowledge. However, due to the persistence, stealth, and diversity of APT attacks, deep learning technique suffers from a series of problems including difficulties of capturing contextual information, low scalability, dynamic evolving of training samples, and scarcity of training samples. Aiming at these problems, this paper proposes APT-KGL, an intelligent APT detection system based on provenance data and graph neural networks. First, APT-KGL models the system entities and their contextual information in the provenance data by a HPG (Heterogeneous Provenance Graph), and learns a semantic vector representation for each system entity in the HPG in an offline way. Then, APT-KGL performs online APT detection by sampling a small local graph from the HPG and classifying the key system entities as malicious or benign. In addition, to conquer the difficulty of collecting training samples of APT attacks, APT-KGL creates virtual APT training samples from open threat knowledge in a semi-automatic way. We conducted a series of experiments on two provenance datasets with simulated APT attacks. The experiment results show that APT-KGL outperforms other current deep learning based models, and has competitive performance against state-of-the-art rule-based APT detection systems.

DETECTION OF ADVANCED PERSISTENT THREATS USING SIEM RULESETS

Cyber-attacks move towards a sophisticated, destructive, and persistent position, as in the case of Stuxnet, Dark Hotel, Poseidon, and Carbanak. These attacks are called Advanced Persistent Threats (APTs), in which an intruder establishes an undetected presence in a network to steal sensitive data over a prolonged period. APT attacks threaten the main critical areas of today's digitalized life. This threat covers critical infrastructures, finance, energy, and aviation agencies. One of the most significant APT attacks was Stuxnet, which targeted the software controlling the programmable logic controllers (PLCs) that are, in turn, used to automate machine processes. The other one was the Deep Panda attack discovered in 2015, which compromised over 4 million US personnel records because of the ongoing cyberwar between China and the US. This paper explains the difficulties of detecting APTs and examines some of the research in this area. In addition, we also present a new approach to detecting APTs using the Security Information and Event Management (SIEM) solution. In this approach, we recommend establishing APT rulesets in SIEM solutions using the indicators left behind by the attacks. The three basic indicator types are considered in the rulesets and are examined in detail.

Fuzzy inference based feature selection and optimized deep learning for Advanced Persistent Threat attack detection

SummaryOne of the attacks that have rapidly happen is Advanced Persistent Threat (APT). APT attacks contain different sophisticated approaches and methods of attacking targets for stealing confidential as well as sensitive information. This research introduced novel and effective APT attack detection techniques, namely Smart Flower Cosine Algorithm‐driven Deep Convolutional Neural Network (SFCA‐DeepCNN). Here, the APT attack detection is done by the DeepCNN, wherein the weight of DeepCNN is updated by the proposed SFCA. The SFCA is modeled by unifying the Smart Flower Optimization Algorithm (SFOA) and Sine Cosine Algorithm (SCA). Additionally, the pre‐processing process is done by Quantile normalization, and the features are chosen based on the fuzzy‐based distance measures. Moreover, data augmentation is done to increase the size of data by performing the oversampling that avoids the overfitting problems. Furthermore, the proposed optimized deep learning scheme detects the accurate APT detection outcome. The performance improvement of the proposed method for testing accuracy is 9.417%, 10.47%, 4.232%, and 3.068% higher than the existing methods, such as, Deep Learning, Support Vector Machine (SVM), Bidirectional Long Short‐Term Memory (Bi‐LSTM), and Hidden Markov Model (HMM).

APT Attack Detection Based on Graph Convolutional Neural Networks

Advanced persistent threat (APT) attacks are malicious and targeted forms of cyberattacks that pose significant challenges to the information security of governments and enterprises. Traditional detection methods struggle to extract long-term relationships within these attacks effectively. This paper proposes an APT attack detection model based on graph convolutional neural networks (GCNs) to address this issue. The aim is to detect known attacks based on vulnerabilities and attack contexts. We extract organization-vulnerability relationships from publicly available APT threat intelligence, along with the names and relationships of software security entities from CVE, CWE, and CAPEC, to generate triple data and construct a knowledge graph of APT attack behaviors. This knowledge graph is transformed into a homogeneous graph, and GCNs are employed to process graph features, enabling effective APT attack detection. We evaluate the proposed method on the dataset constructed in this paper. The results show that the detection accuracy of the GCN method reaches 95.9%, improving by approximately 2.1% compared to the GraphSage method. This approach proves to be effective in real-world APT attack detection scenarios.

APTSHIELD: A Stable, Efficient and Real-Time APT Detection System for Linux Hosts

Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

A prospective approach to detect advanced persistent threats: Utilizing hybrid optimization technique

Advanced Persistent Threat (APT) attacks pose significant challenges for AI models in detecting and mitigating sophisticated and highly effective cyber threats. This research introduces a novel concept called Hybrid HHOSSA which is the grouping of Harris Hawk Optimization (HHO) and Sparrow Search Algorithm (SSA) characteristics for optimizing the feature selection and data balancing in the context of APT detection. In addition, the light GBM as well as the weighted average Bi-LSTM are optimized by the proposed hybrid HHOSSA optimization. The HHOSSA-based attribute selection is used to choose the most important attributes from the provided dataset in the early step of the quasi-identifier detection. The HHOSSA-SMOTE algorithm effectively balances the unbalanced data, such as the lateral movements and the data exfiltration in the DAPT 2020 database, which further improves the classifier performance. The light GBM and the Bi-LSTM classifier hyperparameters are well attuned and classified by the HHOSSA optimization for the precise classification of the attacks. The outcome of both the optimized light GBM and the Bi-LSTM classifier generates the final prediction of the attacks existing in the network. According to the research findings, the HHOSSA-hybrid classifier achieves high accuracy in detecting attacks, with an accuracy rate of 94.468 %, a sensitivity of 94.650 %, and a specificity of 95.230 % with a K-fold value of 10. Also, the HHOSSA-hybrid classifier achieves the highest AUC percentage of 97.032, highlighting its exceptional performance in detecting APT attacks.

DETECTION OF ADVANCED PERSISTENT THREATS USING SIEM RULESETS

Cyber-attacks move towards a sophisticated, destructive, and persistent position, as in the case of Stuxnet, Dark Hotel, Poseidon, and Carbanak. These attacks are called Advanced Persistent Threats (APT) in which an intruder establishes an undetected presence in a network in order to steal sensitive data over a prolonged period of time. In today's digitalized life, these attacks threaten the main critical life areas. This threat is followed by critical infrastructures, finance, energy, and aviation agencies. One of the biggest APT attacks was Stuxnet which targeted software on computers controlling the programmable logic controllers (PLCs) used to automate machine processes. The other one was the Deep Panda attack discovered in 2015 which compromised over 4 million US personnel records because of the ongoing cyberwar between China and the U.S. This paper attempts to explain the difficulties of detecting APTs and to examine the studies in this area. In addition, this paper presents a new approach to detecting APTs using the SIEM solution. In this approach, it is recommended to establish APT rulesets in SIEM solutions by using the indicators left behind by the attacks. In the rulesets, 3 basic indicator types are considered, and examples are shared. Keywords: Cyber security, cyber war, APT, SIEM, Intrusion Detection System.

System-level data management for endpoint advanced persistent threat detection: Issues, challenges and trends

Advanced persistent threat (APT) attacks pose significant security threats to governments and large enterprises. Endpoint detection and response (EDR) methods, which are standard solutions to combat APT attacks, can efficaciously respond to associated security threats by leveraging the semantic richness of provenance graphs and clear causality relations to resist illegal tampering. However, the large number of audit logs produced over time, which provide key supporting information for EDR methods, lead to substantial computational overhead and increased storage costs. Therefore, a robust data management framework must be developed. However, most existing reviews discuss data collection, compression, and storage methods independently. Due to the lack of a comprehensive, structured survey of data management strategies, current data management analyses tend to be separated into individual modules, making it difficult to obtain prompt and precise guidance for higher-level security analysis tasks from these analyses. In this paper, a comprehensive and structured survey of data management strategies based on provenance graphs is conducted, the core ideas of the mainstream approaches to each aspect of data management are summarized, and existing approaches are systematically classified and compared. Then, the problems with individual data management modules are investigated, and potential complementary and collaborative strategies are examined based on the insights and challenges of existing work as a basis for recommending best practices for practical deployment. Finally, an ideal data management framework is described to guide future research.

E-Audit: Distinguishing and investigating suspicious events for APTs attack detection

To detect Advanced Persistent Threats (APTs), recent research efforts focus on modeling the common attack kill chain. The provenance graph is one of the proven techniques which maintains a long-term historic correlation of the attack stages to model the kill chain. However, it is overwhelming to model the kill chain by inspecting the high volume of system events. The paper proposes E-Audit, a hybrid (event-correlation and classification) approach to model the APT kill chain based on threat-likely events that are suspicious events on the system. E-Audit first distinguishes the threat-likely events and builds a provenance graph for threat-likely events only. Second, it assesses the APT campaigns, identifies the attack-irrelevant campaigns, and removes the corresponding paths from the graph. The novel sequence-based model assesses the APT campaigns as a sequence to identify the attack-relevant and attack-irrelevant campaigns. We evaluated the effectiveness of E-Audit over the audit logs dataset. We validated it in real-time using audit logs generated over the enterprise network set-up. The experimental results show that E-Audit can distinguish 668 threat-likely events from the 183223 system events in 174 ms on average and effectively detect the APT attacks with 99.71% accuracy and generate the kill chain.

Machine Learning for APT Detection

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveess.

Resisting Multiple Advanced Persistent Threats via Hypergame-Theoretic Defensive Deception

Defensive deception techniques have emerged as a promising proactive defense mechanism to mislead an attacker and thereby achieve attack failure. However, most game-theoretic defensive deception approaches have assumed that players maintain consistent views under uncertainty. They do not consider players’ possible, subjective beliefs formed due to asymmetric information given to them. In this work, we formulate a hypergame between an attacker and a defender where they can interpret the same game differently and accordingly choose their best strategy based on their respective beliefs. This gives a chance for defensive deception strategies to manipulate an attacker’s belief, which is the key to the attacker’s decision-making. We consider advanced persistent threat (APT) attacks, which perform multiple attacks in the stages of the cyber kill chain (CKC) where both the attacker and the defender aim to select optimal strategies based on their beliefs. Through extensive simulation experiments, we demonstrated how effectively the defender can leverage defensive deception techniques while dealing with multi-staged APT attacks in a hypergame in which the imperfect information is reflected based on perceived uncertainty, cost, and expected utilities of both the attacker and defender, the system lifetime (i.e., mean time to security failure), and improved false-positive rates of intrusion detection.

Survey of Malicious PDF Attacks

In recent years, malicious documents have gained widespread attention as one of the primary vectors for Advanced Persistent Threat (APT) attacks. These malicious document attacks employ various sophisticated techniques, including stream object attacks, embedded JavaScript, information entropy attacks, and machine learning. Therefore, it is essential to pay attention to the existing research findings and trends. Stream object attacks leverage stream objects in PDF or Office documents to hide malicious code, bypassing traditional detection methods. Embedded JavaScript executes malicious actions, such as downloading malware or launching network attacks. Information entropy attacks utilize the information entropy characteristics within documents to detect concealed malicious activities. This article examines and summarizes the current status and progress in each domain. In conclusion, it reviews and proposes research related to embedded JavaScript, information entropy attacks, and machine learning.

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Industrial Internet of Things (IIoT) is vulnerable to Advanced Persistent Threat (APT). This paper studies a scenario in which APT is launched to attack IIoT devices. Considering the APT's lateral movement, a node-level state evolution model is established to calculate the probability of every device in an IIoT system to be compromised by APT. Based on this, a Stackelberg game model is proposed for the APT attacker and defender, which can accurately describe the gaming process. An effective computational approach is developed to obtain the potential Stackelberg equilibrium strategy pair of the game. Extensive case studies and comparison studies are conducted to validate the effectiveness of the proposed method.

Equipment classification based differential game method for advanced persistent threats in Industrial Internet of Things

This paper is dedicated to solving the problem of Advanced Persistent Threat (APT) attack and defense in the Industrial Internet of Things (IIoT). Due to the diversity of IIoT equipment and the inconsistency of protection capabilities, it is difficult for the existing uniform defense strategy and the random defense strategy to achieve ideal results. Considering that both attackers and defenders aim to achieve maximum benefits by paying the minimum cost, as well as the differences between devices, this paper proposes an equipment classification based differential game method for APT in IIoT. Firstly, all equipment is divided into two categories according to their protective capabilities. Secondly, the APT attack and defense process is mathematically described, and the corresponding differential game problem is formulated and analyzed theoretically. Finally, the theoretical results of this method are verified by various experiments, including the comparisons with the uniform defense strategy, the random defense strategy, and the latest model.

A Highly Compatible Verification Framework with Minimal Upgrades to Secure an Existing Edge Network

Edge networks are providing services for an increasing number of companies, and they can be used for communication between edge devices and edge gateways. However, the performance of edge devices varies greatly, and it is not easy to upgrade low-performance edge devices. Therefore, cyber attackers can use the vulnerability of edge devices to implement advanced persistent threat attacks. This article proposes a network verification framework for edge networks that can minimize the upgrades needed to strengthen edge network security. First, the communication parties use the data transmitted by the given edge network. Our method uses our proposed PacketVerifier to attach verification information to the packet after it is sent and to verify and restore the packet before it reaches the receiver. Second, due to the performance requirements of edge networks, we design a new data processing structure, namely, a sliding window double ring, to improve the performance of strict sequential protocols in parallel validation. Finally, experimental simulations show that our parallel processing algorithm has good performance in terms of network bandwidth compared with two existing packet processing algorithms. Furthermore, the proposed packet with verification information is compatible with the existing network topology, which helps PacketVerifier establish trustworthy transmission in a zero-trust environment.