Busca avançada
Ano de início
Entree


Devil in the Noise: Detecting Advanced Persistent Threats with Backbone Extraction

Texto completo
Autor(es):
Viana, Caio M. C. ; Ferreira, Carlos H. G. ; Murai, Fabricio ; dos Santos, Aldri Luiz ; Pereira, Lourenco Alves, Jr.
Número total de Autores: 5
Tipo de documento: Artigo Científico
Fonte: 2024 IEEE SYMPOSIUM ON COMPUTERS AND COMMUNICATIONS, ISCC 2024; v. N/A, p. 7-pg., 2024-01-01.
Resumo

The use of host intrusion detection systems shows promising results in detecting APT campaigns due to the use of systems logs as source data to get more information about system environment. However, dealing with the increase of logs in time while tracking the execution context is a challenge for security analysts. Therefore, this work presents backbone extraction as a crucial preprocessing step, filtering out irrelevant logs. As the logs are modeled as provenance graphs, we discard spurious edges to detect residuals with distinctive node and edge distributions that indicate security threats. By applying our methodology to state-of-the-art benchmark datasets, we observed an increase in the performance of one-class classifiers by up to 62% on F1-score and 48% on recall in the Streamspot dataset and by up to 40% on F1-score and 33% on recall in the DARPA3 THEIA dataset. Moreover, our results indicate mitigation of the dependency explosion problem and underscore the ability of our methodology to improve the detection landscape by shrinking graph sizes without losing essential aspects to characterize attacks. (AU)

Processo FAPESP: 22/00741-0 - Centro de Excelência em Inteligência Artificial para Segurança Cibernética
Beneficiário:Teresa Bernarda Ludermir
Modalidade de apoio: Auxílio à Pesquisa - Programa Centros de Pesquisa em Engenharia
Processo FAPESP: 23/00721-1 - Quantificação de incerteza em aprendizado federado adversário
Beneficiário:Heitor Soares Ramos Filho
Modalidade de apoio: Auxílio à Pesquisa - Regular
Processo FAPESP: 20/09850-0 - Centro de Pesquisa Aplicada em Inteligência Artificial: impulsionando a transformação das indústrias rumo ao padrão 5.0
Beneficiário:Jefferson de Oliveira Gomes
Modalidade de apoio: Auxílio à Pesquisa - Programa Centros de Pesquisa em Engenharia