A Comprehensive Survey on Advanced Persistent Threat (APT) Detection Techniques

1. An overview article on 600% increase in cyber attack in 2021

2. Detection of malicious PDF files and directions for enhancements: A state-of-the art survey10.1016/j.cose.2014.10.014 ↗

3. Persistent and evasive attacks uncovered10.1016/S1754-4548(11)70069-9 ↗

4. Special issue on advanced persistent threat10.1016/j.future.2017.11.005 ↗

5. A graph analytic metric for mitigating advanced persistent threat

6. A comprehensive study on APT attacks and countermeasures for future networks and communications: Challenges and solutions10.1007/s11227-016-1850-4 ↗

7. Worrall · The Biggest Hack in History-Operation Shady RAT.

8. APT detection system using honeypots

9. Survey of intrusion detection systems: Techniques, datasets and challenges10.1186/s42400-019-0038-7 ↗

10. A survey on the cyber security of small-to-medium businesses: Challenges, research focus and recommendations10.1109/ACCESS.2022.3197899 ↗

11. A. Waldman “Mandiant upgrades Sandworm to APT44 due to increasing threat,” Accessed: Apr. 22, 2024. [Online]. Available: https://www.techtarget.com/searchsecurity/news/366581178/Mandiant-upgrades-Sandworm-to-APT44-due-to-increasing-threat

12. A study on advanced persistent threats10.1007/978-3-662-44885-4_5 ↗

13. Advanced persistent threats and their defense methods in industrial internet of things: A survey10.3390/math11143115 ↗

14. Advanced persistent threats defense techniques: A review

15. Review of anomaly detection systems in industrial control systems using deep feature learning approach10.4236/eng.2021.131003 ↗

16. User behavior analytics in advanced persistent threats: A comprehensive review of detection and mitigation strategies

17. The advanced persistent threat

18. Real-time APT detection technologies: A literature review

19. A systematic literature review on advanced persistent threat behaviors and its detection strategy

20. PwC and BAE, “Operation cloud hopper,” Accessed: Apr. 15, 2017. [Online]. Available: https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-report-april-2017.pdf

21. Affiliation not available advanced persistent threats based on supply chain vulnerabilities: Challenges, solutions and future directions

22. Mandiant, “APT41 (Double Dragon):A Dual Espionage and Cyber Crime Operation,” Accessed: Jul. 18, 2024. [Online]. Available: https://www.mandiant.com/resources/reports/apt41-double-dragon-dual-espionage-and-cyber-crime-operation

23. A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities10.1109/COMST.2019.2891891 ↗

24. Survey of publicly available reports on advanced persistent threat actors10.1016/j.cose.2017.08.005 ↗

25. Users really do plug in USB drives they find

26. Advanced persistent threats-detection and defense

27. A study on security framework against advanced persistent threat

28. Advance persistent threat—A systematic review of literature and meta-analysis of threat vectors10.1007/978-981-15-4409-5_15 ↗

29. 5 Stages of an Advanced Persistent Threat Attack on Your Network. Accessed: Jun. 22, 2024, n.d.. [Online]. Available: https://www.whymeridian.com/blog/bid/399610/5-stages-of-an-advanced-persistent-threat-attack-on-your-network

30. Targeted cyberattacks: A superset of advanced persistent threats

31. Spear-phishing email: Most favored APT attack bait, trend mciro incorporated research paper

32. Are software updates useless against advanced persistent threats?10.1145/3571452 ↗

33. Sood · Chapter 2–Intelligence Gathering · Apr. 18, 2014

34. R. Benchea, C. Vatamanu, A. Maximciuc, and V. Lunacasu, “Bitdefender-APT28 under the scope: A journey into exfiltrating intelligence and government information,” 2015. Accessed: Apr. 01, 2024. [Online]. Available: https://www.bitdefender.com/blog/labs/apt28-under-the-scope-a-journey-into-exfiltrating-intelligence-and-government-information/

35. J. Calvet, “Tidal Cyber-Sednit Espionage Group Attacking Air-Gapped Networks,” 2014. Accessed: May 19, 2024. [Online]. Available: https://app.tidalcyber.com/references/8673f7fc-5b23-432a-a2d8-700ece46bd0f

36. A. Team, “The projectsauron APT,” 2016. Accessed: Apr. 01, 2024. [Online]. Available: chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190156/The-ProjectSauron-APT_Technical_Analysis_KL.pdf

37. GReAT (Global Research & Analysis Team), “Turla renews its arsenal with Topinambour | Securelist,” Jul. 2019. Accessed: Jun. 07 2024. [Online]. Available: https://securelist.com/turla-renews-its-arsenal-with-topinambour/91687/

38. J. McCarthy, Cybersecurity for Smart Inverters. doi: 10.6028/NIST.IR.8498.ipd.10.6028/NIST.IR.8498.ipd ↗

39. “National vulnerability database (NVD) | NIST,” Accessed: May 19, 2024. [Online]. Available: https://www.nist.gov/programs-projects/national-vulnerability-database-nvd

40. Cybersecurity Ventures and Herjavec Group, “2019 official annual cybercrime report,” Feb. 2019. Accessed: May 19, 2024. [Online]. Available: https://library.cyentia.com/report/report_003357.html

41. J. Gardiner, M. Cova, and S. Nagaraja, “Command & control: Understanding, denying and detecting,” 2014. Accessed: Apr. 01, 2024. [Online]. Available: http://arxiv.org/abs/1408.1136v1%5Cnpapers3://publication/uuid/4389EDB2-DA22-4672-8B1F-A0F60556CA73

42. A survey of advanced persistent threats attack and defense

43. Cyber kill chain-based taxonomy of advanced persistent threat actors: Analogy of tactics, techniques, and procedures

44. Domain adaptation for windows advanced persistent threat detection10.1016/j.cose.2021.102496 ↗

45. A survey of exploitation techniques and defenses for program data attacks10.1016/j.jnca.2020.102534 ↗

46. Advanced persistent threats: Behind the scenes

47. A novel approach for detecting advanced persistent threats10.1016/j.eij.2022.06.005 ↗

48. The study of APT attack stage model

49. The big four—What we did wrong in advanced persistent threat detection?

50. M. J. Assante and R. M. Lee, “The industrial control system cyber kill chain,” 2015. Accessed: Apr. 01, 2024. [Online]. Available: www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf

51. Modeling advanced persistent threats to enhance anomaly detection techniques

52. Perceiving human psychological consistency: Attack detection against advanced persistent social engineering10.1007/978-3-031-53555-0_15 ↗

53. A flexible framework for malicious open XML document detection based on APT attacks

54. Disguised executable files in spear-phishing emails: Detecting the point of entry in advanced persistent threat

55. A practical approach to E-mail spam filters to protect data from advanced persistent threat

56. Advanced persistent threat and spear phishing emails

57. ALPD: Active learning framework for enhancing the detection of malicious PDF files

58. Duqu: Analysis, detection, and lessons learned

59. Anomaly detection in log data using graph databases and machine learning to defend advanced persistent threats

60. “DeepEnd Research: Library of malware traffic patterns,” Accessed: May 19, 2024. [Online]. Available: http://www.deependresearch.org/2013/04/library-of-malware-traffic-patterns.html

61. Detection of command and control in advanced persistent threat based on independent access

62. A method of monitoring and detecting APT attacks based on unknown domains10.1016/j.procs.2019.02.058 ↗

63. Constructing APT attack scenarios based on intrusion kill chain and fuzzy clustering10.1155/2017/7536381 ↗

64. Anteater: Advanced persistent threat detection with program network traffic behavior10.1109/ACCESS.2024.3349943 ↗

65. R. Zhang, W. Sun, J. Liu, J. Li, G. Lei and H. Guo, “Construction of two statistical anomaly features for small-sample APT attack traffic classification,” 2020. Accessed: Apr. 01, 2024. [Online]. Available: http://arxiv.org/abs/2010.13978

66. Discovering suspicious APT behaviors by analyzing DNS activities

67. A large-scale domain graph in information-centric IoT10.1109/ACCESS.2019.2894509 ↗

68. Malicious domain name detection based on extreme machine learning10.1007/s11063-017-9666-7 ↗

69. Graph-based APT detection

70. Identifying APT malware domain based on mobile DNS logging10.1155/2017/4916953 ↗

71. Unsupervised detection of APT C&C channels using web request graphs10.1007/978-3-319-60876-1_17 ↗

72. APT traffic detection based on time transform

73. Efficient and accurate behavior-based tracking of malware-control domains in large ISP networks10.1145/2960409 ↗

74. Detecting APT malware infections based on malicious DNS and traffic analysis10.1109/ACCESS.2015.2458581 ↗

75. Algorithms and architectures for parallel processing

76. Ctracer: Uncover C&C in advanced persistent threats based on scalable framework for enterprise log data

77. A study on various attacks and detection methodologies in software defined networks10.1007/s11277-020-07387-y ↗

78. Proposed framework for network lateral movement detection based on user risk scoring in SIEM

79. B. Glithero, “Better threat detection and response with analytics for lateral movement,” Jan. 2017. Accessed: May 20. [Online]. Available: https://tanzu.vmware.com/content/blog/better-threat-detection-and-response-with-analytics-for-lateral-movement

80. A comprehensive detection method for the lateral movement stage of APT attacks10.1109/JIOT.2023.3322412 ↗

81. Leveraging token-based representation to detect lateral movement

82. Uncovering lateral movement using authentication logs10.1109/TNSM.2021.3054356 ↗

83. Latte: Large-scale lateral movement detection

84. A machine learning approach for RDP-based lateral movement detection

85. Lateral movement detection using distributed data fusion

86. Using bipartite anomaly features for cyber security applications

87. A Markov multi-phase transferable belief model: An application for predicting data exfiltration APTs

88. Deep reinforcement learning for advanced persistent threat detection in wireless networks

89. Detection of malicious and low throughput data exfiltration over the DNS protocol10.1016/j.cose.2018.09.006 ↗

90. Advanced persistent threat analysis using splunk

91. Modeling attack process of advanced persistent threat using network evolution10.1587/transinf.2016INP0007 ↗

92. AD2: Anomaly detection on active directory log data for insider threat monitoring

93. BAN: Predicting APT attack based on Bayesian network with MITRE ATT&CK framework10.1109/ACCESS.2023.3306593 ↗

94. APT detection: An incremental correlation approach

95. Advanced persistent threat detection using data provenance and metric learning10.1109/TDSC.2022.3221789 ↗

96. Detecting APT attacks using an attack intent-driven and sequence-based learning approach10.1016/j.cose.2024.103748 ↗

97. Alerts correlation and causal analysis for APT based cyber attack detection10.1109/ACCESS.2020.3021499 ↗

98. Detecting apt attacks using an extended sequence-based learning approach

99. A semantic-based correlation approach for detecting hybrid and low-level APTs10.1016/j.future.2019.01.056 ↗

100. Hidden Markov models and alert correlations for the prediction of advanced persistent threats10.1109/ACCESS.2019.2930200 ↗