A comprehensive study on APT attacks and countermeasures for future networks and communications: challenges and solutions

Singh, Saurabh; Sharma, Pradip Kumar; Moon, Seo Yeon; Moon, Daesung; Park, Jong Hyuk

doi:10.1007/s11227-016-1850-4

Cited by 95 publications

(38 citation statements)

References 63 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Mirco Marchetti et al [14] detected hosts with suspicious behavior by analyzing a large number of host features. Yong Shi et al [10] used principal component analysis, k-means clustering, and outlier detection based on median absolute bias.…”

Section: Existing Apt Detection Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Discovering Suspicious APT Behaviors by Analyzing DNS Activities

Yan

Guo

et al. 2020

Sensors

View full text Add to dashboard Cite

As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT.

show abstract

Section: Existing Apt Detection Methodsmentioning

confidence: 99%

“…Meicong Li et al divide an APT attack into four stages [13]: Preparation, Access, Resident, and Harvest. In [14], on the prediction and analyses of APT attacks, Saurabh Singh et al express their belief that attacks can form an attack cycle composed of Reconnaissance, Breach, Infiltration, Exfiltration, and Stealth persistence.…”

Section: Attacking Models Of Aptmentioning

confidence: 99%

Discovering Suspicious APT Behaviors by Analyzing DNS Activities

Yan

Guo

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…In this way, it is foreseen that vehicular network endures an indistinguishable security issue from cloud computing. The primary security difficulties of the vehicular network include [23][24][25][26][27][28][29]:…”

Section: Privacy and Security Of Vehicular Networkmentioning

confidence: 99%

Block-VN: A Distributed Blockchain Based Vehicular Network Architecture in Smart City

2017

J Inf Process Syst

View full text Add to dashboard Cite

In recent decades, the ad hoc network for vehicles has been a core network technology to provide comfort and security to drivers in vehicle environments. However, emerging applications and services require major changes in underlying network models and computing that require new road network planning. Meanwhile, blockchain widely known as one of the disruptive technologies has emerged in recent years, is experiencing rapid development and has the potential to revolutionize intelligent transport systems. Blockchain can be used to build an intelligent, secure, distributed and autonomous transport system. It allows better utilization of the infrastructure and resources of intelligent transport systems, particularly effective for crowdsourcing technology. In this paper, we proposes a vehicle network architecture based on blockchain in the smart city (Block-VN). Block-VN is a reliable and secure architecture that operates in a distributed way to build the new distributed transport management system. We are considering a new network system of vehicles, Block-VN, above them. In addition, we examine how the network of vehicles evolves with paradigms focused on networking and vehicular information. Finally, we discuss service scenarios and design principles for Block-VN.

show abstract

“…In this regard, the Advanced Persistent Threats (APT) represent the most critical hazard in recent years. These are sophisticated attacks perpetrated against a specific organization, where the attacker has considerable experience and resources to penetrate the victim's network, using a multitude of vulnerabilities and attack vectors [3]. They use stealthy techniques to go undetected for a prolonged period of time, from the initial intrusion to the subsequent propagation movements (a.k.a.…”

Section: Introductionmentioning

confidence: 99%

Enhancing Security and Dependability of Industrial Networks with Opinion Dynamics

Rubio¹,

Manulis²,

Alcaraz³

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Opinion Dynamics poses a novel technique to accurately locate the patterns of an advanced attack against an industrial infrastructure, compared to traditional intrusion detection systems. This distributed solution provides profitable information to identify the most affected areas within the network, which can be leveraged to design and deploy tailored response mechanisms that ensure the continuity of the service. In this work, we base on this multi-agent collaborative approach to propose a response technique that permits the secure delivery of messages across the network. For such goal, our contribution is twofold: firstly, we redefine the existing algorithm to assess not only the compromise of nodes, but also the security and quality of service of communication links; secondly, we develop a routing protocol that prioritizes the secure paths throughout the topology considering the information obtained from the detection system.

show abstract

A comprehensive study on APT attacks and countermeasures for future networks and communications: challenges and solutions

Cited by 95 publications

References 63 publications

Discovering Suspicious APT Behaviors by Analyzing DNS Activities

Discovering Suspicious APT Behaviors by Analyzing DNS Activities

Block-VN: A Distributed Blockchain Based Vehicular Network Architecture in Smart City

Enhancing Security and Dependability of Industrial Networks with Opinion Dynamics

Contact Info

Product

Resources

About