General, Efficient, and Real-Time Data Compaction Strategy for APT Forensic Analysis

Zhu, Tiantian; Wang, Jiayu; Ruan, Linqi; Xiong, Chunlin; Yu, Jinkai; Li, Yaosheng; Chen, Yan; Lv, Mingqi; Chen, Tieming

doi:10.1109/tifs.2021.3076288

Cited by 21 publications

(10 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similarly, Conan [29] prefiltered the duplicated read events through semantic recognition to reduce the detection efficiency. Zhu et al [59] maintained a long list to record redundant events. However, the above three methods are only applicable to specific event types, and have limitations in complex scenarios (e.g., when files are accessed by multiple processes, or there are a large number of file write operations, or the real-time performance of the system will deteriorate as the collection time increases).…”

Section: Related Workmentioning

confidence: 99%

“…For each edge, there will be a timestamp and an event name to represent the event sequence and the meaning of the event, respectively. In some research studies of data compaction [18,29,59], system events are able to be merged with multiple timestamps or time ranges.…”

Section: Dependence Graph and Dependencymentioning

confidence: 99%

“…During backward analysis, the timestamp is used to judge the causal relationship between different events. For the second task, forward analysis is used to analyze the impact of attacks [25,59], such as accessing to sensitive information, tampering with system configuration, etc. The origin of forward analysis is usually the attack entry point obtained by backward analysis or any point in the attack chain.…”

Section: Forensic Analysismentioning

confidence: 99%

“…To address this problem, we design a time window T to retain the network receiving events at a low frequency, which is inspired by [25,59]. For example, if T = 50, then after every 50 time intervals, the semantics of IP/DNS will be refreshed and retained again.…”

Section: Insight For Data Compactionmentioning

confidence: 99%

“…In addition, we also evaluate the CPU and memory overhead of APTSHIELD with/without pruning, which will be discussed in detail in Section 5.3. [47] H L L FD (2018) [25] L M H GS (2021) [59] M H H…”

Section: Ratmentioning

confidence: 99%

See 4 more Smart Citations

APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts

Zhu¹,

Yu²,

Chen³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT attacks have caused serious security threats and massive financial loss worldwide. Academics and industry thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios.To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Dependence Graph and Dependencymentioning

confidence: 99%

Section: Forensic Analysismentioning

confidence: 99%

Section: Insight For Data Compactionmentioning

confidence: 99%

Section: Ratmentioning

confidence: 99%

See 3 more Smart Citations