Name
Abstract | ||
|---|---|---|
Advanced Persistent Threats (APT) involve multiple attack steps over a long period, and their investigation requires analysis of myriad logs to identify their attack steps, which are a set of activities undertaken to run an APT attack. However, on a daily basis in an enterprise, intrusion detection systems generate many threat alerts of suspicious events (attack symptoms). Cyber analysts must investigate such events to determine whether an event is a part of an attack. With many alerts to investigate, cyber analysts often end up with alert fatigue, causing them to ignore a large number of alerts and miss true attack events. In this paper, we present ATLAS, a framework that constructs an end-to-end attack story from off-the-shelf audit logs. Our key observation is that different attacks may share similar abstract attack strategies, regardless of the vulnerabilities exploited and payloads executed. ATLAS leverages a novel combination of causality analysis, natural language processing, and machine learning techniques to build a sequence-based model, which establishes key patterns of attack and non-attack behaviors from a causal graph. At inference time, given a threat alert event, an attack symptom node in a causal graph is identified. ATLAS then constructs a set of candidate sequences associated with the symptom node, uses the sequence-based model to identify nodes in a sequence that contribute to the attack, and unifies the identified attack nodes to construct an attack story. We evaluated ATLAS with ten real-world APT attacks executed in a realistic virtual environment. ATLAS recovers attack steps and construct attack stories with an average of 91.06% precision, 97.29% recall, and 93.76% F1-score. Through this effort, we provide security investigators with a new means of identifying the attack events that make up the attack story. |
Year | Venue | DocType |
|---|---|---|
2021 | PROCEEDINGS OF THE 30TH USENIX SECURITY SYMPOSIUM | Conference |
Citations | PageRank | References |
0 | 0.34 | 0 |
Authors | ||
8 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| A Alsaheel | 1 | 0 | 0.34 |
| Y.-N. Yeh | 2 | 253 | 44.47 |
| Shiqing Ma | 3 | 67 | 9.00 |
| Lean Yu | 4 | 1777 | 179.93 |
| G Walkup | 5 | 0 | 0.34 |
| Z. Berkay Celik | 6 | 851 | 43.59 |
| Xiangyu Zhang | 7 | 2857 | 151.00 |
| D Xu | 8 | 1 | 1.02 |