More Like this

1. A Collaborative Forensic Framework for Detecting Advanced Persistent Threats

   https://doi.org/10.18293/seke2021-052  

   Xu, Weifeng (July 2021, International Conferences on Software Engineering and Knowledge Engineering)
2. Decepticon: a Theoretical Framework to Counter Advanced Persistent Threats

   https://doi.org/10.1007/s10796-020-10087-4  

   Baksi, Rudra P.; Upadhyaya, Shambhu J. (November 2020, Information Systems Frontiers)

   null (Ed.)
3. UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

   Han, Xueyuan; Pasquier, Thomas; Bates, Adam; Mickens, James; Seltzer, Margo (January 2020, Network and Distributed System Security Symposium)

   Advanced Persistent Threats (APTs) are difficult to detect due to their “low-and-slow” attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without pre-defined attack signatures. Using a graph sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects real-life APT scenarios with high accuracy. 

   more » « less
4. A Strategic Framework for Mitigating Advanced Persistent Threats: A Hidden Markov Model Approach

   Baksi, R.; Upadhyaya, S. (July 2019, 2nd Conference on Risk Analysis, Decision Analysis and Security, Niagara Falls, NY)

   Deception has been proposed in the literature as an effective defense mechanism to address Advanced Persistent Threats (APT). However, administering deception in a cost-effective manner requires a good understanding of the attack landscape. In this paper, we develop a Hidden Markov Model based framework where the indicators of compromise (IoC) are used as the observables. This framework would help in selecting an appropriate deception script and triggering the proper defensive strategy when faced with APTs or other malware. The effectiveness of the model and the associated framework are illustrated by considering ransomware as the offending APT in a networked system. 

   more » « less
5. Cloud Storage Defense Against Advanced Persistent Threats: A Prospect Theoretic Study

   https://doi.org/10.1109/JSAC.2017.2659418  

   Xiao, Liang; Xu, Dongjin; Xie, Caixia; Mandayam, Narayan B.; Poor, H. Vincent (March 2017, IEEE Journal on Selected Areas in Communications)