An efficient classification model for detecting advanced persistent threat

Chandran, Saranya; Hrudya, P.; Poornachandran, Prabaharan

doi:10.1109/icacci.2015.7275911

Cited by 33 publications

(16 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…A commonly known malicious worm Stuxnet is an example of APT attack that targets production systems. The developers of these sophisticated attacks are skilled and well funded since they are tailor-made to the target networks and systems [1][2][3][4][5] -the cyber security risk at the targeted side is very high.…”

Section: Apt Attackmentioning

confidence: 99%

See 1 more Smart Citation

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

Bodström

Hämäläinen

2018

Computational Data and Social Networks

View full text Add to dashboard Cite

Advanced Persistent Threat(APT) attacks are a major concern for the modern societal digital infrastructures due to their highly sophisticated nature. The purpose of these attacks varies from long period espionage in high level environment to causing maximal destruction for targeted cyber environment. Attackers are skilful and well funded by governments in many cases. Due to sophisticated methods it is highly important to study proper countermeasures to detect these attacks as early as possible. Current detection methods under-performs causing situations where an attack can continue months or even years in a targeted environment. We propose a novel method for analysing APT attacks through OODA loop and Black Swan theory by defining them as a multivector multi-stage attacks with continuous strategical ongoing campaign. Additionally it is important to notice that for developing better performing detection methods, we have to find the most common factor within these attacks. We can state that the most common factor of APT attacks is communication, thus environment has to be developed in a way that we are able to capture complete network flow and analyse it.

show abstract

Section: Apt Attackmentioning

confidence: 99%

“…The attack can also use more than one attack vectors simultaneously. [1][2][3][4][5][6][7][8][9][10] Another weakness that help attackers is the fact that 100% secure systems does not exist. Even well designed and protected systems and networks have their weak spots [8].…”

Section: Apt Attackmentioning

confidence: 99%

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

Bodström

Hämäläinen

2018

Computational Data and Social Networks

View full text Add to dashboard Cite

show abstract

“…The detection is based on a number of thresholds defined based on these metrics. In [15], a classification model based on machine learning techniques is presented. This model is evaluated using a malware employed to implement an APT.…”

Section: Related Workmentioning

confidence: 99%

Multi-Stage Attack Detection Using Contextual Information

Aparicio-Navarro

Kyriakopoulos

Ghafir

et al. 2018

MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM)

View full text Add to dashboard Cite

The appearance of new forms of cyber-threats, such as Multi-Stage Attacks (MSAs), creates new challenges to which Intrusion Detection Systems (IDSs) need to adapt. An MSA is launched in multiple sequential stages, which may not be malicious when implemented individually, making the detection of MSAs extremely challenging for most current IDSs. In this paper, we present a novel IDS that exploits contextual information in the form of Pattern-of-Life (PoL), and information related to expert judgment on the network behaviour. This IDS focuses on detecting an MSA, in real-time, without previous training process. The main goal of the MSA is to create a Point of Entry (PoE) to a target machine, which could be used as part of an APT like attack. Our results verify that the use of contextual information improves the efficiency of our IDS by enhancing the detection rate of MSAs in real-time by 58%.

show abstract

“…A classi cation model for APT detection is presented in [14]. is model is built based on machine learning algorithms.…”

Section: Related Workmentioning

confidence: 99%

Malicious SSL Certificate Detection

Ghafir

Přenosil

Hammoudeh

et al. 2017

Proceedings of the International Conference on Future Networks and Distributed Systems

View full text Add to dashboard Cite

Advanced Persistent reat (APT) is one of the most serious types of cyber a acks, which is a new and more complex version of multistep a ack. Within the APT life cycle, continuous communication between infected hosts and Command and Control (C&C) servers is maintained to instruct and guide the compromised machines. ese communications are usually protected by Secure Sockets Layer (SSL) encryption, making it di cult to identify if the tra c directed to sites is malicious. is paper presents a Malicious SSL certi cate Detection (MSSLD) module, which aims at detecting the APT C&C communications based on a blacklist of malicious SSL certi cates. is blacklist consists of two forms of SSL certi cates, the SHA1 ngerprints and the serial & subject, that are associated with malware and malicious activities. In this detection module, the network tra c is processed and all secure connections are ltered. e SSL certi cate of each secure connection is then matched with the SSL certi cate blacklist. is module was experimentally evaluated and the results show successful detection of malicious SSL certi cates.

show abstract

An efficient classification model for detecting advanced persistent threat

Cited by 33 publications

References 17 publications

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

Multi-Stage Attack Detection Using Contextual Information

Malicious SSL Certificate Detection

Contact Info

Product

Resources

About