Detecting Advanced Persistent Threats using Fractal Dimension based Machine Learning Classification

Siddiqui, Sana; Khan, Muhammad Salman; Ferens, Ken; Kinsner, W.

doi:10.1145/2875475.2875484

Cited by 61 publications

(30 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Friedberg et al [2015] explain the shortcomings of current security solutions with regards to APT detection, in particular contending that preventive security mechanisms and signature-based methods are not enough to tackle the challenge of APTs, and propose an anomaly detection-based framework to detect APTs by learning a model of normal system behavior from host-based security logs and detecting deviations. Siddiqui et al [2016] use the fractal dimension as a feature to classify TCP/IP session data patterns into anomalous (and part of an APT) or normal patterns. Moya et al [2017] construct decision tree-based models of normal network activity based on features extracted from firewall logs, then use the learned models to classify incoming network traffic.…”

Section: Related Workmentioning

confidence: 99%

A baseline for unsupervised advanced persistent threat detection in system-level provenance

Berrada

Cheney

Benabderrahmane

et al. 2020

Future Generation Computer Systems

View full text Add to dashboard Cite

Advanced persistent threats (APT) are stealthy, sophisticated, and unpredictable cyberattacks that can steal intellectual property, damage critical infrastructure, or cause millions of dollars in damage. Detecting APTs by monitoring system-level activity is difficult because manually inspecting the high volume of normal system activity is overwhelming for security analysts. We evaluate the effectiveness of unsupervised batch and streaming anomaly detection algorithms over multiple gigabytes of provenance traces recorded on four different operating systems to determine whether they can detect realistic APT-like attacks reliably and efficiently. This report is the first detailed study of the effectiveness of generic unsupervised anomaly detection techniques in this setting.

show abstract

Section: Related Workmentioning

confidence: 99%

A baseline for unsupervised advanced persistent threat detection in system-level provenance

Berrada

Cheney

Benabderrahmane

et al. 2020

Future Generation Computer Systems

View full text Add to dashboard Cite

show abstract

“…To obtain the traffic data, we have monitored the university-enterprise network for one month. Specifically, we simulate the P2P botnet and HTTP botnet attack according to the Contagio blog [21] and white paper [22], which provide guidance about how to make botnet evade intrusion detection techniques. To simulate the XSS attacks, we inject malicious code into the web pages of university servers.…”

Section: Datasetmentioning

confidence: 99%

Integrating Traffics with Network Device Logs for Anomaly Detection

Zhuo

et al. 2019

Security and Communication Networks

View full text Add to dashboard Cite

Advanced cyberattacks are often featured by multiple types, layers, and stages, with the goal of cheating the monitors. Existing anomaly detection systems usually search logs or traffics alone for evidence of attacks but ignore further analysis about attack processes. For instance, the traffic detection methods can only detect the attack flows roughly but fail to reconstruct the attack event process and reveal the current network node status. As a result, they cannot fully model the complex multistage attack. To address these problems, we present Traffic-Log Combined Detection (TLCD), which is a multistage intrusion analysis system. Inspired by multiplatform intrusion detection techniques, we integrate traffics with network device logs through association rules. TLCD correlates log data with traffic characteristics to reflect the attack process and construct a federated detection platform. Specifically, TLCD can discover the process steps of a cyberattack attack, reflect the current network status, and reveal the behaviors of normal users. Our experimental results over different cyberattacks demonstrate that TLCD works well with high accuracy and low false positive rate.

show abstract

“…Technical countermeasures have been proposed by (Huang and Zhu, 2019), where a multi-stage Bayesian game framework can capture incomplete information of deceptive APTs and their multistage multi-phase movement. (Siddiqui et al, 2016) proposed classification of APT based on anomalous traffic patterns using a feature vector obtained during processing of TCP/IP session information. A disguised executable file detection (DeFD) module system, which aims to detect disguised executable files transferred over network connections, has been proposed by (Ghafir et al, 2018).…”

Section: Research On Apt Countermeasuresmentioning

confidence: 99%

Modelling Technical Countermeasures of Advanced Persistent Threats

Nicho¹,

McDermott²

2019

Proceedings of the 16th International Conference on Applied Computing 2019

View full text Add to dashboard Cite

An advanced persistent threat (APT) is a highly targeted and sophisticated attack directed at the internetworked computer user at the workplace. They typically employ zero-day malware, stealth, and multiple advanced techniques to gain entry and maintain presence undetected inside the network. As a result, preventing their ingress at the network perimeter and detection once infiltration occurs, continues to be a challenge. In this respect, the major objective of this research is to propose a classification schema for the APT technical countermeasures. We interviewed senior managers working in government and private organizations in the United Arab Emirates over a period of four years (2014 to 2017) to gain their perspective of the threat and elicit technical countermeasures. We anticipate the proposed methods and practices can assist organizations, not only in the UAE but also in the wider global context, to implement an appropriate mix of countermeasures for APT threats from a multi-dimensional perspective.

show abstract

Detecting Advanced Persistent Threats using Fractal Dimension based Machine Learning Classification

Cited by 61 publications

References 11 publications

A baseline for unsupervised advanced persistent threat detection in system-level provenance

A baseline for unsupervised advanced persistent threat detection in system-level provenance

Integrating Traffics with Network Device Logs for Anomaly Detection

Modelling Technical Countermeasures of Advanced Persistent Threats

Contact Info

Product

Resources

About