Towards a Timely Causality Analysis for Enterprise Security

Abstract

Abstract-The increasingly sophisticated Advanced Persistent Threat (APT) attacks have become a serious challenge for enterprise IT security. Attack causality analysis, which tracks multi-hop causal relationships between files and processes to diagnose attack provenances and consequences, is the first step towards understanding APT attacks and taking appropriate responses. Since attack causality analysis is a time-critical mission, it is essential to design causality tracking systems that extract useful attack information in a timely manner. However, prior work is limited in serving this need. Existing approaches have largely focused on pruning causal dependencies totally irrelevant to the attack, but fail to differentiate and prioritize abnormal events from numerous relevant, yet benign and complicated system operations, resulting in long investigation time and slow responses.To address this problem, we propose PRIOTRACKER, a backward and forward causality tracker that automatically prioritizes the investigation of abnormal causal dependencies in the tracking process. Specifically, to assess the priority of a system event, we consider its rareness and topological features in the causality graph. To distinguish unusual operations from normal system events, we quantify the rareness of each event by developing a reference model which records common routine activities in corporate computer systems. We implement PRIOTRACKER, in 20K lines of Java code, and a reference model builder in 10K lines of Java code. We evaluate our tool by deploying both systems in a real enterprise IT environment, where we collect 1TB of 2.5 billion OS events from 150 machines in one week. Experimental results show that PRIOTRACKER can capture attack traces that are missed by existing trackers and reduce the analysis time by up to two orders of magnitude.

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

“…Provenance graphs are increasingly popular for attack analysis [15], [40], [79], [102] and are attractive for APT detection. In particular, provenance graphs capture causality relationships between events.…”

HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows

“…Among these, BEEP [34], ProTracer [39], and MPI [38] use training and code instrumentation and annotations to divide process executions into smaller units, to address dependency explosion and provide better forensic analysis. PrioTracker [36] performs timely causality analysis by quantifying the notion of event rareness to prioritize the investigation of abnormal causal dependencies. In contrast, HOLMES uses system event traces to perform realtime detection, with integrated forensics capabilities in the detection framework, in the form of high-level attack steps, without requiring instrumentation.…”

Threat Intelligence Computing

“…• Application of human-defined knowledge [3,7,30,55,87] • Modeling trojan/ransomware behaviors [6,41,46,89] • Modeling botnet behaviors [5,28,37,62,97] • Modeling malicious download behaviors [36,45,46,84] • Modeling malicious browser extension behaviors [40] • Modeling malware behaviors [4,18,44,51,60,86] • Modeling malicious graph communities [39,70,91,97] • Modeling permitted behaviors [17,24,25,29,82,88] • Knowledge discovery on graphs [71,81,94] • Attack causality tracking and inference [42,47,54,85] • Anomaly detection [16,20,23,50,58,59,...…”

“…Existing threat hunting practices fulfill this need with a mash-up solution -importing security and non-security data of all kinds into a SIEM [31,34] and employing SOC analysts for connecting the dots with the human languages/concepts as the universal interface. The procedure is aided by static threat model approaches for wellmodeled tasks, such as call chain traversal [9,54] or knowledge standardization for retrieval and sharing [35,52,68,83,95]. Performing threat hunting through graph computations establishes new programmability requirements beyond existing graph programming platforms [12,65] (discussed in Section 2).…”