Diagnosing Advanced Persistent Threats: A Position Paper

• Tipo: Artigo em Livro de Atas de Conferência Internacional
• Data: 2015

Autores

Rui Abreu (Autor) FEUP; Bobrow, DG (Autor) Outra; Eldardiry, H (Autor) Outra; Feldman, A (Autor) Outra; Hanley, J (Autor) Outra; Honda, T (Autor) Outra; Kleer, Jd (Autor) Outra; Perez, A (Autor) Outra; Archer, D (Autor) Outra; Burke, D (Autor) Outra

Ata de Conferência Internacional

Título: Proceedings of the 26th International Workshop on Principles of Diagnosis (DX-2015) co-located with 9th IFAC Symposium on Fault Detection, Supervision and Safety for Technical Processes (Safeprocess 2015), Paris, France, August 31 - September 3, 2015.

Páginas: 193-200

Indexação

Scopus - 7 Citações

Outras Informações

ID Authenticus: P-00K-AQK

Abstract (EN): When a computer system is hacked, analyzing the root-cause (for example entry-point of penetration) is a diagnostic process. An audit trail, as defined in the National Information Assurance Glossary, is a securityrelevant chronological (set of) record(s), and/or destination and source of records that provide evidence of the sequence of activities that have affected, at any time, a specific operation, procedure, or event. After detecting an intrusion, system administrators manually analyze audit trails to both isolate the root-cause and perform damage impact assessment of the attack. Due to the sheer volume of information and low-level activities in the audit trails, this task is rather cumbersome and time intensive. In this position paper, we discuss our ideas to automate the analysis of audit trails using machine learning and model-based reasoning techniques. Our approach classifies audit trails into the high-level activities they represent, and then reasons about those activities and their threat potential in real-time and forensically. We argue that, by using the outcome of this reasoning to explain complex evidence of malicious behavior, we are equipping system administrators with the proper tools to promptly react to, stop, and mitigate attacks.

Idioma: Inglês

Tipo (Avaliação Docente): Científica

Nº de páginas: 7