Cyber situation perception for Internet of Things systems based on zero‐day attack activities recognition within advanced persistent threat

Abstract

With the development of the Internet of Things (IoT) technology, various attacks and threats have emerged. The advanced persistent threat (APT) refers to a class of advanced multiple-steps attacks among diverse attack activities, which brings severe threats to the IoT systems ascribe to its pertinence, concealment, and permeability.However, the existing technologies and methods fail to timely recognize the APT attack activities (especially the zero-day exploits) in a comprehensive scope. To address this problem, we propose a novel method of cyber situation perception for IoT systems, which based on zero-day attack activity recognition within APT (CSPAPTM). Moreover, we also design an edge computing framework for applying CSPAPTM to the typical IoT systems. Specifically, we first provide a cyber situation perception ontology construction module for describing the APT attack activities. Then, a malicious C&C DNS mining method (MCCDRM) is proposed to control the APT malicious activity correlation analysis trigger, which can effectively decrease the computing overhead. Finally, we propose a zero-day attack activity recognition method within APT (ZDAARA), which acts on system call instances to recognize the malicious activities, which cannot be detected by IDS. A relatively mature access control mechanism PO-SAAC is also applied to our method. Through the coalescent of these methods, CSPAPTM can accomplish the cyber situation perception effectively by the zero-day attack activities recognition in the IoT systems. The exhaustive experimental results demonstrate that the two kernel modules, that is, MCCDRM and ZDAARA in our CSPAPTM, can achieve both higher F 1 score and acceptable false positive rate.

Exploring the vulnerability in the inference phase of advanced persistent threats

“…Due to these characteristics, APTs are difficult to be detected by traditional detection techniques, such as intrusion detection technology, vulnerability detection technology and malicious code detection technology. 20 IoT have been widely used in modern life. IoT refer to the system composed of interconnected and interrelated devices, objects and sensors.…”

“…Due to these characteristics, APTs are difficult to be detected by traditional detection techniques, such as intrusion detection technology, vulnerability detection technology and malicious code detection technology. 20…”

Advanced Persistent Threats (APT)-Attribution-MICTIC Framework Extension

“…According to Cheng et al (2020), APTs are a specific class of multi-attacks different from traditional attacks and as such the traditional methods now in place do not solve this type of problem. They are undetectable by conventional technological means as they use "zero-days" technology.…”

“…According to Cheng et al (2020), even in IoT it is difficult to manage detecting APTs with conventional mechanisms.…”

A Hybrid Alarm Association Method Based on AP Clustering and Causality

“…Various advanced multistep attacks are also appearing more and more frequently. Due to their penetration, pertinence, and concealment, they pose a serious threat to the Internet of Things [7]. In addition to this, the types of attacks on the network are becoming more abundant [8], such as worm attacks, vulnerability attacks, denial of service (DoS) attacks, and phishing attacks.…”