kth.sePublikationer KTH
Ändra sökning
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
APTer: Towards the Investigation of APT Attribution
Nanyang Technological University, Singapore.
KTH, Skolan för elektroteknik och datavetenskap (EECS), Datavetenskap, Nätverk och systemteknik.ORCID-id: 0000-0003-0479-6766
National University of Singapore, Singapore.
Nanyang Technological University, Singapore.
Visa övriga samt affilieringar
2023 (Engelska)Ingår i: Proceedings - 2023 IEEE Conference on Dependable and Secure Computing, DSC 2023, Institute of Electrical and Electronics Engineers (IEEE) , 2023Konferensbidrag, Publicerat paper (Refereegranskat)
Abstract [en]

The rise of Advanced Persistent Threats (APTs) in recent years has sparked widespread concern in the cyber domain. APT-based cyberattacks are often stealthy, multistaged, slow-moving, low-profile, and time-consuming. Furthermore, these attacks consist of a series of steps, each employing a different technique variation. Consequently, most existing approaches are inadequate for analyzing the behavior of such attacks effectively. To prevent potential compromises, a proactive APT defense strategy that can identify potential APT stages and attribute them to a specific APT group is required. Therefore, for both public and private organizations, the correlation and attribution of these attacks are crucial. In this paper, we propose APTer, a preliminary effort towards the archetype of APT attribution. The first aim of the research is to correlate multiple stages of APTs based on threat alerts. To define and correlate the APT stages, APTer first eliminates redundant threat alerts and clusters the remaining ones. Second, APTer uses a novel APT stage prediction mechanism to forecast future APT phases. We have developed a prediction model to determine the next APT stages. Finally, APTer attributes the identified and predicted stages to a particular APT group. APT attribution aims to find MITRE ATTCK Tools, Tactics, and Procedures (TTPs) that indicate possible threats by a specific group correlated with the MITRE ATTCK knowledge base. Additionally, we perform mapping of Common Vulnerability Exploits (CVEs) to MITRE ATTCK to provide additional knowledge about existing vulnerabilities that can be mapped to the MITRE ATTCK technique. We have evaluated our work on real-world datasets from Third Party. Our results show that APTer can correlate, predict, attribute, and map with high accuracy of 97.3% and low false-positive rates of 2.1%.

Ort, förlag, år, upplaga, sidor
Institute of Electrical and Electronics Engineers (IEEE) , 2023.
Nationell ämneskategori
Datavetenskap (datalogi)
Identifikatorer
URN: urn:nbn:se:kth:diva-342652DOI: 10.1109/DSC61021.2023.10354155Scopus ID: 2-s2.0-85182271950OAI: oai:DiVA.org:kth-342652DiVA, id: diva2:1831246
Konferens
6th IEEE Conference on Dependable and Secure Computing, DSC 2023, Tampa, United States of America, Nov 7 2023 - Nov 9 2023
Anmärkning

Part of ISBN 9798350382112

QC 20240125

Tillgänglig från: 2024-01-25 Skapad: 2024-01-25 Senast uppdaterad: 2024-07-01Bibliografiskt granskad

Open Access i DiVA

Fulltext saknas i DiVA

Övriga länkar

Förlagets fulltextScopus

Person

Patil, Rajendra

Sök vidare i DiVA

Av författaren/redaktören
Patil, Rajendra
Av organisationen
Nätverk och systemteknik
Datavetenskap (datalogi)

Sök vidare utanför DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetricpoäng

doi
urn-nbn
Totalt: 274 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf