SEQUIN: a grammar inference framework for analyzing malicious system behavior

Abstract

Targeted attacks on IT systems are a rising threat to the confidentiality of sensitive data and the availability of critical systems. The emergence of Advanced Persistent Threats (APTs) made it paramount to fully understand the particulars of such attacks in order to improve or devise effective defense mechanisms. Grammar inference paired with visual analytics (VA) techniques offers a powerful foundation for the automated extraction of behavioral patterns from sequential event traces. To facilitate the interpretation and analysis of APTs, we present SEQUIN, a grammar inference system based on the Sequitur compression algorithm that constructs a context-free grammar (CFG) from string-based input data. In addition to recursive rule extraction, we expanded the procedure through automated assessment routines capable of dealing with multiple input sources and types. This automated assessment enables the accurate identification of interesting frequent or anomalous patterns in sequential corpora of arbitrary quantity and origin. On the formal side, we extended the CFG with attributes that help describe the extracted (malicious) actions. Discovery-focused pattern visualization of the output is provided by our dedicated KAMAS VA prototype.

Advanced threat intelligence: detection and classification of anomalous behavior in system processes

“…Figure 5 shows a summary. Note that "SE-QUIN" is an optional component discussed in [27]. For both binary and CAPEC multi-class classification, the core classification system utilizing SVM with hyperplane optimization offers the highest accuracy with 99.82% and 95.73%, respectively.…”

AIDIS: Detecting and classifying anomalous behavior in ubiquitous kernel processes

“…For the purpose of compression we utilize prior work, SEQUIN [42], a grammar inference system based on the Sequitur algorithm, which constructs a context-free grammar (CFG) from string-based input data. Specifically, Sequitur is a greedy compression algorithm that creates a hierarchical structure 575 from a sequence of discrete symbols by recursively replacing repeated phrases with a grammatical rule [53].…”

“…The full rule extraction and evaluation process is detailed in [42]. The article describes the application of our adapted Sequitur system on smart traces of kernel events associated with arbitrary processes and other security-relevant data, proving a full example grammar.…”

“…The reduction of input data in particular can be helpful to decrease the complexity of lengthier analysis tasks, such as the graph-based approach discussed in this paper (see Section 4.5.1): By using SEQUIN, it is possible to slim down the input corpus to only relevant n-grams (n ≥ 2), instead of working with 590 the full, unfiltered set of event or code snippet unigrams. SEQUIN's grammar transformation mechanism [42] also enables us to work with an automatically generated placeholder variable instead of several compound terminals.…”

“…See Section 5 for an evaluation of the compression component in the context of AIDIS. Refer to [42] for more information about this and other SEQUIN 595 components.…”