Diagnosing Advanced Persistent Threats: A Position Paper

• Type: Article in International Conference Proceedings Book
• Date: 2015

Authors

Rui Abreu (Author) FEUP; Bobrow, DG (Author) Other; Eldardiry, H (Author) Other; Feldman, A (Author) Other; Hanley, J (Author) Other; Honda, T (Author) Other; Kleer, Jd (Author) Other; Perez, A (Author) Other; Archer, D (Author) Other; Burke, D (Author) Other

Conference proceedings International

Title: Proceedings of the 26th International Workshop on Principles of Diagnosis (DX-2015) co-located with 9th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes (Safeprocess 2015), Paris, France, August 31 - September 3, 2015.

Pages: 193-200

Indexing

Scopus - 7 Citations

Other information

Authenticus ID: P-00K-AQK

Abstract (EN): When a computer system is hacked, analyzing the root-cause (for example entry-point of penetration) is a diagnostic process. An audit trail, as defined in the National Information Assurance Glossary, is a securityrelevant chronological (set of) record(s), and/or destination and source of records that provide evidence of the sequence of activities that have affected, at any time, a specific operation, procedure, or event. After detecting an intrusion, system administrators manually analyze audit trails to both isolate the root-cause and perform damage impact assessment of the attack. Due to the sheer volume of information and low-level activities in the audit trails, this task is rather cumbersome and time intensive. In this position paper, we discuss our ideas to automate the analysis of audit trails using machine learning and model-based reasoning techniques. Our approach classifies audit trails into the high-level activities they represent, and then reasons about those activities and their threat potential in real-time and forensically. We argue that, by using the outcome of this reasoning to explain complex evidence of malicious behavior, we are equipping system administrators with the proper tools to promptly react to, stop, and mitigate attacks.

Language: English

Type (Professor's evaluation): Scientific

No. of pages: 7