APT-Attack Detection Based on Multi-Stage Autoencoders

Abstract

In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector.

A quantitative method to evaluate covertness of APT attack

“…For attack detection systems and security status monitoring systems, observable data is the key information to discover attacks, which includes measurement indicators, such as CPU utilization, disk usage, the rate of network traffic transmission, and also includes the network data flow, system logs, the application information, process information and so on. In order to maintain the covertness, the attacker will minimize the difference from the normal phase of the target system on the basis of achieving the target in the attack phase [10]. This difference and the change of the system represent the covertness of the attack phase.…”

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

“…Thus, a comparison with SOTA approaches as a baseline is obligatory, e. g., comparisons with other AI/ML-based approaches and/or signature-based IDS, such as Suricata 3 or Snort 4 . Up-todate approaches should also discuss early detection, zeroday attacks, and multi-stage attacks, as these are increasingly problematic to detect [30]. This hypothesis is important for Maggie Manager, as she is the one that wants to buy and include an AI/ML tool.…”

Collaborative Federated Learning-Based Model for Alert Correlation and Attack Scenario Recognition

“…With 400 iterations, their model applied to UNSW-NB15 datasets and synthetic datasets from five clients obtained 96.7% accuracy, which is higher than local models. The authors [23] proposed models for anomaly detection on two datasets, namely Contagio and CICIDS2017, using an unsupervised learning approach. Subsequently, the study will explore various known malware attacks targeting networks.…”