A Theoretical Model for Detection of Advanced Persistent Threat in Networks and Systems Using a Finite Angular State Velocity Machine (FAST-VM)

Abstract

Intrusion detection systems have undergone numerous years of study and yet a great deal of problems remain; primarily a high percentage of false alarms and abysmal detection rates. A new type of threat has emerged that of Advanced Persistent Threat. This type of attack is known for being sophisticated and slow moving over a long period of time and is found in networked systems. Such threats may be detected by evaluation of large numbers of state variables describing complex system operation and state transitions over time. Analysis of such large numbers of variables is computationally inefficient especially if it is meant to be done in real time. The paper develops a completely new theoretical model that appears to be able to distill high order state variable data sets down to the essence of analytic changes in a system with APT operating. The model is based on the computationally efficient use of integer vectors. This approach has the capability to analyze threat over time, and has potential to detect, predict and classify new threat as being similar to threat already detected. The model presented is highly theoretical at this point with some initial prototype work demonstrated and some initial performance data.

Dimensions of ‘Socio’ Vulnerabilities of Advanced Persistent Threats

“…APT attacks are highly targeted attacks with clearly defined goals, which typically target governments or businesses, due to their substantial intellectual property value [12] [13]. While APT threats have drawn increased attention from the industrial security community, a comprehensive and clear understanding of the APT research problem is lacking [12].…”

“…APTs are not usually deployed to bring down a business, but to stay embedded within its systems and extract information at a slow and undetected pace [15]. As highly advanced networked entities, typical of organized groups, they conduct hostile cyber-attacks against connected computers; if on a local network or the internet [13]. Using stealth techniques, they aim to continuously monitor, admin-istrate, and steal specific target data in the long term, while staying undetected [16].…”

“…Existing research has focused on generic intrusion detection, with little application to APTs [13]. Hence, APT is a serious issue for current detection methods because these methods depend on known signatures of attacks, while APTs make heavy use of unknown security holes for attacks [18].…”

Modelling Technical Countermeasures of Advanced Persistent Threats

“…Security log analysis using Big data has been proposed by Jeon et al (2016). Here they employed a finite angular state transition velocity machine, and its vector based analytic algebra, to detect APT inside the network (Vert et al, 2014). Network traffic and client data analysis, form multiple network locations, using both signature and anomaly detection methods derived from the intelligent data analysis field, has been proposed by De Vries et al (2012).…”

“…As a highly sophisticated, well-resourced threats aimed primarily towards the government sector (Thakar and Parekh, 2016), the goal of an APT attack is not to just gather a target entity's data, but to accomplish it undetected (Alshamrani et al, 2019). While the majority of cyber-attacks rely on automated scanning and exploitation of known vulnerabilities over large sets of targets (Marchetti et al, 2016), APT attacks are highly targeted attacks, with a clear goal typically targeting governments or business targets with substantial intellectual property value (Chen et al, 2014, Vert et al, 2014. Reports of APT attacks targeting high-profile organizations, ranging from large-scale enterprises and financial institutions to government sectors continue to occur unabated (Yang et al, 2018).…”