Detection of Advanced Persistent Threat based on Kill Chain Node Mapping and LSTM

2021 ◽  
Author(s):  
Juefu Li
Keyword(s):  
Advanced Persistent Threat

Effective Repair Strategy Against Advanced Persistent Threat: A Differential Game Approach

2019 ◽  
Vol 14 (7) ◽  
pp. 1713-1728 ◽  
Author(s):  
Lu-Xing Yang ◽  
Pengdeng Li ◽  
Yushu Zhang ◽  
Xiaofan Yang ◽  
Yong Xiang ◽  
...  
Keyword(s):  
Differential Game ◽  
Advanced Persistent Threat ◽  
Repair Strategy

scholarly journals Mathematical Study of Advanced Persistent Threat (APT) Hunting Techniques

2020 ◽  
pp. 1-24
Author(s):  
Argyrios Alexopoulos ◽  
Nicholas J. Daras
Keyword(s):  
Cyber Attacks ◽  
Nation State ◽  
Cyber Attack ◽  
Mathematical Study ◽  
Cyber Defense ◽  
Modus Operandi ◽  
Protection Measures ◽  
Advanced Persistent Threat ◽  
Rigorous Description ◽  
Cyber Kill Chain

The paper documents, based mainly on [3]-[6] published papers where a consistent mathematical description of cyberspace and various types of Cyber-Attacks and protection measures are presented, a holistic mathematical approach to a rigorous description of Advanced Persistent Threat (APT) actors’ modus operandi through various scenarios and Cyber Kill Chain stages [2]. After referring [6] to the various elements of Cyber-Attacks we propose some techniques (via 5 scenarios) of tracking the modus operandi of the most sophisticated and non-linear cyber actors, the Advanced Persistent Threat actors that are usually nation-state or nation-state backed and usually stay undetected for an extended time in later stages of Cyber Kill Chain in defenders’ networks. Keywords: Valuation of cyber assets, vulnerability of cyber assets, node supervision, sophistication of an attack germ of cyber-attack, cyber defense, proactive cyber protection, Advanced Persistent Threat (APT) actors, Indication of Compromise (IOC), Tactics, Techniques and Procedures (TTPs).

MODELING, ANALYSIS AND COUNTERING SCENARIOS OF PREPARING COMPUTER ATTACKS REALIZED BY THE GROUP APT3 IN DISTRIBUTED COMPUTER SYSTEMS

2021 ◽  
pp. 35-46
Author(s):  
Алексей Леонидович Сердечный ◽  
Александр Владимирович Айдаркин ◽  
Михаил Андреевич Тарелкин ◽  
Анна Евгеньевна Дешина
Keyword(s):  
Petri Nets ◽  
Computer Systems ◽  
Protection System ◽  
Protection Measures ◽  
Advanced Persistent Threat ◽  
Modeling Methods ◽  
Modeling Analysis ◽  
Protected Object ◽  
Computer Attacks ◽  
Distributed Computer Systems

В работе представлены результаты моделирования способов реализации долговременных целенаправленных атак на корпоративные распределённые компьютерные системы со стороны одной из опасных киберпреступных группировкок - Advanced Persistent Threat 3 (APT3). Осуществлено моделирование способов, реализуемых APT3. Построение моделей осуществлялось с использованием аппарата сетей Петри на основании сведений о технических приёмах, содержащихся в базе данных MITRE ATT&CK. Разработанные модели взаимосвязаны по условиям и последствиям реализации основных технических приёмов, актуальных для корпоративных распределённых компьютерных сетей. Реализованный подход также позволяет моделировать меры защиты, регламентируемые нормативными и методическим документами, что даст возможность принятия обоснованных решений при построении системы защиты с учётом специфики защищаемого объекта. The paper presents the results of modeling methods for implementing APT-attacks on corporate distributed computer systems by one of the most dangerous cybercrime groups - Advanced Persistent Threat 3 (APT3). The methods implemented by APT3 are modeled. The models were constructed using the Petri nets apparatus based on the information about technical techniques contained in the MITRE ATT&CK database. The developed models are interrelated in terms of the conditions and consequences of the implementation of the main technical techniques relevant for corporate distributed computer networks. The implemented approach also allows to model the protection measures from regulatory and methodological documents, which will make it possible to make informed decisions when building a protection system, taking into account the specifics of the protected object.

MODELING, ANALYSIS AND COUNTERING SCENARIOS OF PREPARING COMPUTER ATTACKS REALIZED BY THE GROUP APT29 IN DISTRIBUTED COMPUTER SYSTEMS

2021 ◽  
pp. 83-92
Author(s):  
Алексей Леонидович Сердечный ◽  
Павел Сергеевич Краюшкин ◽  
Михаил Андреевич Тарелкин ◽  
Юрий Константинович Язов
Keyword(s):  
Petri Nets ◽  
Computer Systems ◽  
Network Models ◽  
Protection Measures ◽  
Markov Network ◽  
Advanced Persistent Threat ◽  
Modeling Analysis ◽  
Computer Attacks ◽  
The Relationship ◽  
Distributed Computer Systems

Статья посвящена моделированию компьютерных атак на распределённые корпоративные компьютерные системы, на примере действий группировки Advanced Persistent Threat 29 (APT29). В статье предлагается подход моделирования способов, реализуемых указанной группировкой, а также мер защиты от них. Подход основан на использовании аппарата сетей Петри, а также сведений о технических приёмах, предоставляемых в рамках проекта MITRE ATT&CK. Разработанные модели учитывают связи по условиям и последствиям действий, совершаемых группировкой APT29 в ходе атак на распределённые корпоративные системы. Также в статье продемонстрирована возможность наращивания модели за счёт включения в неё моделей мер защиты от рассмотренных способов реализации компьютерных атак. Предлагаемые модели могут быть дополнены за счёт моделирования новых способов реализации компьютерных атак, используемых другими кибергруппировками. Кроме того, модели могут быть расширены до моделей сети Петри-Маркова путём реализации частным методик расчёта вероятностно-временных характеристик для фрагментов предлагаемых моделей. The article is devoted to modeling computer attacks on distributed corporate computer systems, using the example of the actions of the Advanced Persistent Threat 29 (APT29) group. The article proposes an approach to modeling the methods implemented by this grouping, as well as measures to protect against them. The approach is based on Petri nets and information about the techniques (MITRE ATT&CK project). The developed models take into account the relationship between the conditions and consequences of actions committed by the APT29 group during attacks on distributed enterprise systems. The article also demonstrates the possibility of increasing the model by including models of protection measures against the considered methods of implementing computer attacks. The proposed models can be supplemented by modeling new ways of implementing computer attacks used by other cyber groups. In addition, the models can be extended to Petri-Markov network models by implementing special methods for calculating probabilistic-time characteristics for fragments of the proposed models.

Advanced Persistent Threat Detection: A Survey

2021 ◽  
Author(s):  
Adam Khalid ◽  
Anazida Zainal ◽  
Mohd Aizaini Maarof ◽  
Fuad A. Ghaleb
Keyword(s):  
Threat Detection ◽  
Advanced Persistent Threat

Improved Methodology to Detect Advanced Persistent Threat Attacks

2020 ◽  
pp. 184-202
Author(s):  
Ambika N.
Keyword(s):  
Intellectual Property ◽  
Public Key Cryptography ◽  
Public Key ◽  
Sleep Mode ◽  
Data Reliability ◽  
Advanced Persistent Threat ◽  
Hash Code ◽  
Long Time

Cybersecurity is essentials in today's era. An increase in cyberattacks has driven caution to safeguard data. An advanced persistent attack is an attack where the intellectual property of an organization is attempted to be misused. The attacker stays on the network for a long-time intruding into confidential files. The attacker switches into sleep mode, masking himself. Hence, the attacker is quite difficult to trace. The proposed work is suggested to tackle the problem. Public key cryptography is used to encrypt the data. The hash code is affixed to the transmitted message to provide reliability to the transmitted data. The work proves to be 4.9% stronger in authenticating the received packets, provides 4.42% greater data reliability, and decreases the load of the server by 43.5% compared to work.

scholarly journals MD-MinerP: Interaction Profiling Bipartite Graph Mining for Malware-Control Domain Detection

2020 ◽  
Vol 2020 ◽  
pp. 1-20
Author(s):  
Tzung-Han Jeng ◽  
Yi-Ming Chen ◽  
Chien-Chih Chen ◽  
Chuan-Chiang Huang
Keyword(s):  
Network Traffic ◽  
Graph Mining ◽  
Single Point ◽  
Bipartite Graphs ◽  
Traffic Data ◽  
Domain Names ◽  
Advanced Persistent Threat ◽  
Threat Intelligence ◽  
Extraction Stage

Despite the efforts of information security experts, cybercrimes are still emerging at an alarming rate. Among the tools used by cybercriminals, malicious domains are indispensable and harm from the Internet has become a global problem. Malicious domains play an important role from SPAM and Cross-Site Scripting (XSS) threats to Botnet and Advanced Persistent Threat (APT) attacks at large scales. To ensure there is not a single point of failure or to prevent their detection and blocking, malware authors have employed domain generation algorithms (DGAs) and domain-flux techniques to generate a large number of domain names for malicious servers. As a result, malicious servers are difficult to detect and remove. Furthermore, the clues of cybercrime are stored in network traffic logs, but analyzing long-term big network traffic data is a challenge. To adapt the technology of cybercrimes and automatically detect unknown malicious threats, we previously proposed a system called MD-Miner. To improve its efficiency and accuracy, we propose the MD-MinerP here, which generates more features with identification capabilities in the feature extraction stage. Moreover, MD-MinerP adapts interaction profiling bipartite graphs instead of annotated bipartite graphs. The experimental results show that MD-MinerP has better area under curve (AUC) results and found new malicious domains that could not be recognized by other threat intelligence systems. The MD-MinerP exhibits both scalability and applicability, which has been experimentally validated on actual enterprise network traffic.

Sign in / Sign up

Export Citation Format

Share Document