A Cyber Kill Chain Approach for Detecting Advanced Persistent Threats
Source abstract
Abstract
The number of cybersecurity incidents is on the rise despite significant investment in security measures. The existing conventional security approaches have demonstrated limited success against some of the more complex cyber-attacks. This is primarily due to the sophistication of the attacks and the availability of powerful tools. Interconnected devices such as the Internet of Things (IoT) are also increasing attack exposures due to the increase in vulnerabilities. Over the last few years, we have seen a trend moving towards embracing edge technologies to harness the power of IoT devices and 5G networks. Edge technology brings processing power closer to the network and brings many advantages, including reduced latency, while it can also introduce vulnerabilities that could be exploited. Smart cities are also dependent on technologies where everything is interconnected. This interconnectivity makes them highly vulnerable to cyber-attacks, especially by the Advanced Persistent Threat (APT), as these vulnerabilities are amplified by the need to integrate new technologies with legacy systems. Cybercriminals behind APT attacks have recently been targeting the IoT ecosystems, prevalent in many of these cities. In this paper, we used a publicly available dataset on Advanced Persistent Threats (APT) and developed a data-driven approach for detecting APT stages using the Cyber Kill Chain. APTs are highly sophisticated and targeted forms of attacks that can evade intrusion detection systems, resulting in one of the greatest current challenges facing security professionals. In this experiment, we used multiple machine learning classifiers, such as Naïve Bayes, Bayes Net, KNN, Random Forest and Support Vector Machine (SVM). We used Weka performance metrics to show the numeric results. The best performance result of 91.1% was obtained with the Naïve Bayes classifier. We hope our proposed solution will help security professionals to deal with APTs in a timely and effective manner.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Information and Cyber Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (48)
Show source-provided references
1. I. Ponemon, “Cost of a data breach report,” IBM Technical Report, 2020.
2. Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack10.1016/j.cose.2019.07.001 ↗
3. J. Kutscher, “M-Trends 2020: Insights from the front lines,” Milpitas, CA, USA, 2020. [Online]. Available: https://www.fireeye.com/blog/threat-research/2020/02/mtrends-2020-insights-from-the-front-lines.html [Accessed: September 03, 2020].
4. Centrify, “Remote working has increased the risk of a cyber breach, says three quarters of UK businesses,” Santa Clara, CA, USA, 2020. [Online]. Available: https://www.centrify.com/about-us/news/press-releases/2020/remote-working-increased-risk-cyber-breach/ [Accessed: September 03, 2020].
5. Verizon, “Data breach investigation report,” Verizon Technical Report, 2020.10.1016/S1361-3723(20)30059-2 ↗
6. Malwarebytes, “APTs and Covid-19: How advanced persistent threats use the Coronavirus as a lure,” Malwarebytes Technical Report, 2020.
7. GReAT, “APT trends report Q1 2020 APT trends report Q1 2020,” SECURELIST, Kaspersky, 2020. [Online]. Available: https://securelist.com/apt-trends-report-q1-2020/96826/ [Accessed: September 03, 2020].
8. Security Magazine, “Coronavirus campaign spreading Malware,” Troy, MI, USA: BNP Media, 2020. [Online]. Available: https://www.securitymagazine.com/articles/91646-coronavirus-campaigns-spreading-malware [Accessed: September 03, 2020].
9. Detection of advanced persistent threat using machine-learning correlation analysis10.1016/j.future.2018.06.055 ↗
10. FireEye, “FireEye ecosystem: Survival in cyberspace isn’t easy,” FireEye, Milpitas, CA, USA, 2020. [Online]. Available: https://www.fireeye.com [Accessed: September 03, 2020].
11. Kaspersky, “Kaspersky APT intelligence reporting,” Kaspersky, Moscow, Russia, 2020. [Online]. Available: https://www.kaspersky.com/enterprise-security/apt-intelligence-reporting [Accessed: September 03, 2020].
12. FireEye, “Double Dragon: APT41, a dual espionage and cyber crime operation,” FireEye, Milpitas, CA, USA, 2020. [Online]. Available: https://content.fireeye.com/apt-41/rpt-apt41/ [Accessed: September 03, 2020].
13. A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities10.1109/COMST.2019.2891891 ↗
14. Survey of publicly available reports on advanced persistent threat actors10.1016/j.cose.2017.08.005 ↗
15. The study of APT attack stage model
16. Technical aspects of cyber kill chain
17. A cyber kill chain based taxonomy of banking Trojans for evolutionary computational intelligence10.1016/j.jocs.2017.10.020 ↗
18. Cyber kill chain-based taxonomy of advanced persistent threat actors: Analogy of tactics, techniques, and procedures
19. Detecting advanced persistent threats using fractal dimension based machine learning classification
20. Detection and classification of advanced persistent threats and attacks using the support vector machine10.3390/app9214579 ↗
21. Advanced persistent threats: Minimizing the damage10.1016/S1353-4858(14)70040-6 ↗
22. A context-based detection framework for advanced persistent threats
23. Proposed framework for effective detection and prediction of advanced persistent threats based on the cyber kill chain
24. VERIS, “The vocabulary for event recording and incident sharing,” VERIS Community, 2020. [Online]. Available: http://veriscommunity.net/index.html [Accessed: September 03. 2020].
25. OS fingerprinting: New techniques and a study of information gain and obfuscation
26. The Register, “Robots.txt tells hackers the places you don’t want them to look,” 2015. [Online]. Available: https://www.theregister.com/2015/05/19/robotstxt/ [Accessed: September 03, 2020].
27. Semantic exploration of DNS
28. A. Shulman, M. Cherny and S. Dulce, “Compromised insider honey pots using reverse honey tokens,” US Patent US20150135266A1, 2015.
29. USB-based attacks10.1016/j.cose.2017.08.002 ↗
30. Stuxnet and the future of cyber war10.1080/00396338.2011.555586 ↗
31. Detecting malicious URLs using machine learning techniques
32. Cross-site scripting (XSS) attacks and defense mechanisms: Classification and state-of-the-art
33. Detecting malicious powershell commands using deep neural networks
34. Industrial espionage and targeted attacks: Understanding the characteristics of an escalating threat
35. Detection of malicious and low throughput data exfiltration over the DNS protocol10.1016/j.cose.2018.09.006 ↗
36. Network intrusion detection system using attack behavior classification
37. ICA and PCA integrated feature extraction for classification
38. Principal component analysis: A review and recent developments10.1098/rsta.2015.0202 ↗
39. Multiple correspondence analysis
40. Multiple factor analysis: Principal component analysis for multitable and multiblock data sets10.1002/wics.1246 ↗
41. Feature selection: A data perspective
42. Murthy · Pattern Recognition: An Algorithmic Approach · 2011
43. Comparing Bayesian network classifiers
44. Detecting attacks to internal vehicle networks through Hamming distance
45. IMPACT: Impersonation attack detection via edge computing using deep autoencoder and feature abstraction10.1109/ACCESS.2020.2985089 ↗
46. On mitigating hop-to-hop congestion problem in IoT enabled intra-vehicular communication
47. The emergence of Internet of Things (IoT): Connecting anything, anywhere10.3390/computers8020040 ↗
48. A 3D-collaborative wireless network: Towards resilient communication for rescuing flood victims