Loading...

Ontology-based Advanced Persistent Attacks Detection

Mohammadzadeh Lajevardi, Amir | 2019

640 Viewed
  1. Type of Document: Ph.D. Dissertation
  2. Language: Farsi
  3. Document No: 52424 (19)
  4. University: Sharif University of Technology
  5. Department: Computer Engineering
  6. Advisor(s): Amini, Morteza
  7. Abstract:
  8. Advanced Persistent Threats (APTs), use hybrid, slow, and low-level patterns to leak and exfiltrate information, manipulate data, or prevent progression of a program or mission. Since current intrusion detection systems (IDSs) and alert correlation systems do not correlate low-level operating system events with network events and use alert correlation instead of event correlation, the intruders use low and hybrid events in order to make detection difficult for such detection systems. In addition, these attacks use low and slow patterns to bypass intrusion detection and alert correlation systems. Since most of the attack detection approaches use a short time-window, the slow APTs abuse this weakness to escape from detection systems. In these situations, the intruders increase the time of attacks and move as slowly as possible by some tricks such as using sleeper and wake up functions. In this thesis, a new solution is proposed for detecting APTs. The proposed approach uses low-level interception, knowledge-based system, system ontology, and semantic correlation to detect low-level and hybrid attacks. Since using semantic-based correlation is not applicable for detecting slow attacks due to its significant processing overhead, we proposed a scalable knowledge-base system that uses three different concepts and approaches to reduce the time complexity including 1) flexible sliding window called Vermiform window to analyze and correlate system events instead of using fixed-size time-window, 2) effective inference using a scalable inference engine called SANSA, and 3) data reduction by ontology-based data abstraction. We can detect the slow APTs that their attack duration is about several months. One of the main challenges in APT detection field is lack of a standard dataset for evaluation. One of our contributions in this thesis was proposing a standard dataset which can be used by other approaches for evaluation. Our evaluation results on this dataset shows 88.88% of sensitivity and 89.09% of specificity for our proposed approach
  9. Keywords:
  10. Advanced Persistent Treats ; Semantic Correlation ; Ontology ; Low-Level Attack ; Slow Attack ; Hybrid Attack

 Digital Object List

 Bookmark

...see more