A New Proposal on the Advanced Persistent Threat: A Survey
Source abstract
Abstract
An advanced persistent threat (APT) can be defined as a targeted and very sophisticated cyber attack. IT administrators need tools that allow for the early detection of these attacks. Several approaches have been proposed to provide solutions to this problem based on the attack life cycle. Recently, machine learning techniques have been implemented in these approaches to improve the problem of detection. This paper aims to propose a new approach to APT detection, using machine learning techniques, and is based on the life cycle of an APT attack. The proposed model is organised into two passive stages and three active stages to adapt the mitigation techniques based on machine learning.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Information and Cyber Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Applied Mathematics, University of Salamanca, 37008 Salamanca, Spain
Institute of Fundamental Physics and Mathematics, Department of Applied Mathematics, University of Salamanca, 37008 Salamanca, Spain
References (73)
Show source-provided references
1. Swisscom (2019). Targeted Attacks Cyber Security Report 2019, Swisscom (Switzerland) Ltd. Group Security. Technical report.
2. A Study on Advanced Persistent Threats
3. Fireeye (2019). M-Trends 2019: Fireeye Mandiant Services Special Report, Fireeye. Technical report.
4. Survey of publicly available reports on advanced persistent threat actors10.1016/j.cose.2017.08.005 ↗
5. Bai, T., Bian, H., Daya, A.A., Salahuddin, M.A., Limam, N., and Boutaba, R. (2019, January 14–17). A Machine Learning Approach for RDP-based Lateral Movement Detection. Proceedings of the 2019 IEEE 44th Conference Local Computer Networks, Osnabrueck, Germany.10.1109/LCN44214.2019.8990853 ↗
6. Detection of advanced persistent threat using machine-learning correlation analysis10.1016/j.future.2018.06.055 ↗
7. Constructing APT Attack Scenarios Based on Intrusion Kill Chain and Fuzzy Clustering10.1155/2017/7536381 ↗
8. Threat Intelligence Team, M.L. (2020, March 16). APT36 Jumps on the Coronavirus Bandwagon, Delivers Crimson RAT. Available online: https://blog.malwarebytes.com/threat-analysis/2020/03/apt36-jumps-on-the-coronavirus-bandwagon-delivers-crimson-rat/.
9. A Practical Study on Advanced Persistent Threats
10. W32. stuxnet dossier
11. FireEye (2016). Follow the money: Dissecting the Operations of the Cyber Crime Group FIN6, FireEye. Technical Report.
12. Coopers, Pricewaterhouse (2017). Operation Cloud Hopper, PwC UK Cyber Security and Data privacy. Technical report.
13. FireEye (2019). Double Dragon: APT41, a Dual Espionage and Cyber Crime Operation, FireEye. Technical report.
14. Mandiant (2013). APT1 Exposing One of China’s Cyber Espionage Units, Technical report; Mandiant.
15. Advanced social engineering attacks
16. Phishing environments, techniques, and countermeasures: A survey10.1016/j.cose.2017.04.006 ↗
17. Symantec (2016). Internet Security Threat Report, Symantec. Technical Report 2.
18. Analysis of malware download sites by focusing on time series variation of malware10.1016/j.jocs.2017.05.027 ↗
19. Paganini, P. (2019, August 20). Turla APT Group’s Espionage Campaigns Now Employs Adobe Flash Installer and Ingenious Social Engineering. Available online: https://www.cyberdefensemagazine.com/turla-apt-groups-espionage-campaigns-now-employs-adobe-flash-installer-and-ingenious-social-engineering/.
20. ThaiCERT (2019, June 24). Threat Group Cards: A Threat Actor Encyclopedia. Available online: https://www.thaicert.or.th/downloads/files/A_Threat_Actor_Encyclopedia.pdf.
21. Paganini, P. (2019, November 21). Iran-Linked APT33 Updates Infrastructure Following Its Public Disclosure. Available online: https://securityaffairs.co/wordpress/87784/apt/apt33-updates-infrastructure.html.
22. Learning the lessons of WannaCry10.1016/S1361-3723(18)30084-8 ↗
23. Cordey, S. (2019). Trend Analysis: The Israeli Unit 8200—An OSINT-based study, Center for Security Studies (CSS), ETH Zürich. Technical Report.
24. Kasperky Lab (2015). The Duqu 2.0-Technical Details (V2.1), Kasperky Lab. Technical Report.
25. Kaspersky Lab (2019). Targeted Cyberattacks LOGBOOK, Kasperky Lab.
26. Dua, S., and Du, X. (2011). Data Mining and Machine Learning in Cybersecurity, Auerbach Publications.
27. Kaviani, S., and Sohn, I. (2020). Influence of random topology in artificial neural networks: A survey. ICT Express.10.1016/j.icte.2020.01.002 ↗
28. Survey of intrusion detection systems: Techniques, datasets and challenges10.1186/s42400-019-0038-7 ↗
29. Da Silva, I.N., Hernane Spatti, D., Andrade Flauzino, R., Liboni, L.H.B., and dos Reis Alves, S.F. (2017). Artificial Neural Networks, Springer International Publishing.10.1007/978-3-319-43162-8 ↗
30. Context-Dependent Pre-Trained Deep Neural Networks for Large-Vocabulary Speech Recognition10.1109/TASL.2011.2134090 ↗
31. Artificial neural network technique for rainfall forecasting applied to the São Paulo region10.1016/j.jhydrol.2004.06.028 ↗
32. Performance of small-world feedforward neural networks for the diagnosis of diabetes
33. Chu, W.L., Lin, C.J., and Chang, K.N. (2019). Detection and Classification of Advanced Persistent Threats and Attacks Using the Support Vector Machine. Appl. Sci., 9.10.3390/app9214579 ↗
34. Joshi, A.V. (2020). Machine Learning and Artificial Intelligence, Springer International Publishing.10.1007/978-3-030-26622-6 ↗
35. Review: Machine learning techniques applied to cybersecurity10.1007/s13042-018-00906-1 ↗
36. Yang, X.S., and He, X.S. (2020). Implementation of Machine Learning and Data Mining to Improve Cybersecurity and Limit Vulnerabilities to Cyber Attacks. Nature-Inspired Computation in Data Mining and Machine Learning, Springer International Publishing.
37. Cleophas, T.J., and Zwinderman, A.H. (2018). Modern Bayesian Statistics in Clinical Research, Springer International Publishing.10.1007/978-3-319-92747-3 ↗
38. von Davier, M., and Lee, Y.S. (2019). Handbook of Diagnostic Classification Models, Methodology of Educational Measurement and Assessment, Springer International Publishing.10.1007/978-3-030-05584-4 ↗
39. A generalized mean distance-based k-nearest neighbor classifier10.1016/j.eswa.2018.08.021 ↗
40. A new fast search algorithm for exact k-nearest neighbors based on optimal triangle-inequality-based check strategy10.1016/j.knosys.2019.105088 ↗
41. Effects of Distance Measure Choice on K-Nearest Neighbor Classifier Performance: A Review10.1089/big.2018.0175 ↗
42. Awad, M., and Khanna, R. (2015). Hidden Markov Model. Efficient Learning Machines: Theories, Concepts, and Applications for Engineers and System Designers, Apress.10.1007/978-1-4302-5990-9 ↗
43. The use of machine learning algorithms in recommender systems: A systematic review10.1016/j.eswa.2017.12.020 ↗
44. Olivieri, A.C. (2018). Principal Component Analysis. Introduction to Multivariate Calibration: A Practical Approach, Springer International Publishing.10.1007/978-3-319-97097-4_4 ↗
45. A multiple reversible watermarking technique for fingerprint authentication10.1007/s00530-015-0465-6 ↗
46. Principal Component Analysis in the local differential privacy model10.1016/j.tcs.2019.12.019 ↗
47. Yang, L., and Deng, M. (2010, January 29–31). Based on k-Means and Fuzzy k-Means Algorithm Classification of Precipitation. Proceedings of the 2010 International Symposium on Computational Intelligence and Design, Hangzhou, China.10.1109/ISCID.2010.72 ↗
48. Yang, X.S., and He, X.S. (2020). Classification and Clustering Algorithms of Machine Learning with their Applications. Nature-Inspired Computation in Data Mining and Machine Learning, Springer International Publishing.
49. Guan, Z., Bian, L., Shang, T., and Liu, J. (2018). When Machine Learning meets Security Issues: A survey. 2018 IEEE Int. Conf. Intell. Saf. Robot., 158–165.10.1109/IISR.2018.8535799 ↗
50. The Future of Cybersecurity: Major Role of Artificial Intelligence, Machine Learning, and Deep Learning in Cyberspace10.1007/978-981-10-8681-6_67 ↗
51. Mohanty, S., and Vyas, S. (2018). Cybersecurity and AI. How to Compete Age Artificial Intelligence, Apress.10.1007/978-1-4842-3808-0 ↗
52. OWASP (2019, September 19). Unvalidated Redirects and Forwards. Available online: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html.
53. Paganini, P. (2019, October 11). Phishers Continue to Abuse Adobe and Google Open Redirects. Available online: https://securityaffairs.co/wordpress/91877/cyber-crime/adobe-google-open-redirects.html.
54. Detecting lateral spear phishing attacks in organisations10.1049/iet-ifs.2018.5090 ↗
55. Unsupervised Detection of APT C&C Channels using Web Request Graphs
56. Detecting APT Malware Infections Based on Malicious DNS and Traffic Analysis10.1109/ACCESS.2015.2458581 ↗
57. A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection10.1109/COMST.2015.2494502 ↗
58. Machine Learning for Security and the Internet of Things: The Good, the Bad, and the Ugly10.1109/ACCESS.2019.2948912 ↗
59. Su, Y., Li, M., Tang, C., and Shen, R. (2015, January 12–13). A Framework of APT Detection Based on Dynamic Analysis. Proceedings of the 2015 4th National Conference on Electrical, Electronics and Computer Engineering, Xi’an, China.10.2991/nceece-15.2016.187 ↗
60. Giura, P., and Wang, W. (2012, January 14–16). A Context-Based Detection Framework for Advanced Persistent Threats. Proceedings of the 2012 International Conference on Cyber Security, Washington, DC, USA.10.1109/CyberSecurity.2012.16 ↗
61. Wang, X., Zheng, K., Niu, X., Wu, B., and Wu, C. (2016, January 22–27). Detection of command and control in advanced persistent threat based on independent access. Proceedings of the 2016 IEEE International Conference on Communications (ICC), Kuala Lumpur, Malaysia.10.1109/ICC.2016.7511197 ↗
62. Aparicio-navarro, F.J., Kyriakopoulos, K.G., Ghafir, I., Lambotharan, S., Chambers, J.A., and Technology, F. (2018). Multi-Stage Attack Detection Using Contextual Information, Loughborough University.10.1109/MILCOM.2018.8599708 ↗
63. Brogi, G., and Tong, V.V.T. (2016, January 21–23). TerminAPTor: Highlighting advanced persistent threats through information flow tracking. Proceedings of the 2016 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS), Larnaca, Cyprus.10.1109/NTMS.2016.7792480 ↗
64. Proposed models for advanced persistent threat detection: A review10.1007/978-3-030-23946-6_16 ↗
65. DFA-AD: A distributed framework architecture for the detection of advanced persistent threats10.1007/s10586-016-0716-0 ↗
66. Siddiqui, S., Khan, M.S., Ferens, K., and Kinsner, W. (2016, January 11). Detecting Advanced Persistent Threats using Fractal Dimension based Machine Learning Classification. Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics, New Orleans, LA, USA.10.1145/2875475.2875484 ↗
67. Shenwen, L., Yingbo, L., and Xiongjie, D. (2015, January 14–16). Study and research of APT detection technology based on big data processing architecture. Proceedings of the 2015 IEEE 5th International Conference on Electronics Information and Emergency Communication, Beijing, China.10.1109/ICEIEC.2015.7284547 ↗
68. Ussath, M., Jaeger, D., Cheng, F., and Meinel, C. (2016, January 16–18). Advanced persistent threats: Behind the scenes. Proceedings of the 2016 Annual Conference on Information Science and Systems (CISS), Princeton, NJ, USA.10.1109/CISS.2016.7460498 ↗
69. Attack chain detection10.1002/sam.11296 ↗
70. Proposed Approach for Targeted Attacks Detection10.1007/978-3-319-24584-3_7 ↗
71. Trend Micro (2013). The Custom Defense Against Targeted Attacks, Trend Micro. Technical report.
72. Vukalovic, J., and Delija, D. (2015, January 25–29). Advanced Persistent Threats-detection and defense. Proceedings of the 2015 38th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, Croatia.10.1109/MIPRO.2015.7160480 ↗
73. Lockheed Martin (2009). Cyber Kill Chain, Lockheed Martin.