MITRE-Based APT Attack Generation and Prediction

The APT attack on the Internet is becoming more serious, and most of intrusion detection systems can only generate alarms to some steps of APT attack and cannot identify the pattern of the APT attack. To detect APT attack, many researchers established attack models and then correlated IDS logs with the attack models. However, the accuracy of detection deeply relied on the integrity of models. In this paper, we propose a new method to construct APT attack scenarios by mining IDS security logs. These APT attack scenarios can be further used for the APT detection. First, we classify all the attack events by purpose of phase of the intrusion kill chain. Then we add the attack event dimension to fuzzy clustering, correlate IDS alarm logs with fuzzy clustering, and generate the attack sequence set. Next, we delete the bug attack sequences to clean the set. Finally, we use the nonaftereffect property of probability transfer matrix to construct attack scenarios by mining the attack sequence set. Experiments show that the proposed method can construct the APT attack scenarios by mining IDS alarm logs, and the constructed scenarios match the actual situation so that they can be used for APT attack detection.

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

The essence of Internet security is information security, as more and more industries rely on the Internet, in order to protect the information security of these industries, spawned local area networks (LANs), intranets and so on. With the development of information sensor technology, the Internet of Things (IoT) that interconnects physical devices has emerged. As a unity of computing process and physical process, the Cyberphysical systems (CPS) is the next generation intelligent system which integrates computing, communication and control. CyberPhysical systems cover a wide range of applications, including intelligent transportation systems, telemedicine, smart grids, aerospace, and many other fields, many of which involve critical infrastructure. The APT attacks are typically directed against these critical infrastructures around the world. So, timely and accurate detection APT attacks and take effective defensive measures, it is meaningful to protect the national information security. Although APT attacks seem destructive, their attack process are complex and changeable, in essence, they usually follow certain rules. This paper proposes an APT attack analysis framework based on the APT attack rules and current mainstream detection technologies. The framework iteratively matches the collected data with the cyber security knowledge graph, and implements constraints relies on the cyber security knowledge graph and self-defined attack rules, thereby realizing the current security status of the network in real time.

Recently personal information due to the APT attack, the economic damage and leakage of confidential information is a serious social problem, a great deal of research has been done to solve this problem. APT attacks are threatening traditional hacking techniques as well as to increase the success rate of attacks using sophisticated attack techniques such attacks Zero-Day vulnerability in order to avoid detection techniques and state-of-the-art security because it uses a combination of intelligence. In this paper, the malicious code is designed to detect APT attack based on APT attack behavior ontology that occur during the operation on the target system, it uses intelligent APT attack than to define inference rules can be inferred about malicious attack behavior to propose a method that can be detected.

Cyber-attacks, which affect a wide range of areas such as political, economic, and social organizations, continue to evolve along with rapid changes in the IT environment, becoming more intelligent and complex. Especially, APT attacks have specific targets with obvious goals and use complex strategies from multiple perspectives. To proactively defend against these potential attacks, it is important to assess security risks based on a comprehensive and systematic understanding of APT attacks. In this paper, we propose the APT Attack Risk Assessment Framework to evaluate the security risks for specific APT attacks, using Risk-Aware Problem Domain Ontology. The proposed framework can assess the risks in which a specific APT attack affects an organization within a domain.

At present, APT attack detection mainly focuses on the specific realization of detection technology, and there is little research on the timing strategy for active detection of APT attack. This paper focuses on the problem of APT dynamic detection with timing decision intelligence. We use the FlipIt game model and reinforcement learning method of Q-learning algorithm, consider the APT attack events as an exponentially distributed random process, and the defender using the attacker’s last move time (LM-defender) to learn his optimal timing strategy using Q-Learning algorithm. The defender's reinforcement learning mechanism for the timing of the APT attack action and outputs its timing selection strategy. Simulation experiments show that compared with the existing greedy algorithm, the timing strategy based on the Q-Learning algorithm does not require the attacker's prior information under the premise, it can achieve a higher average benefit than the greedy strategy. This result provides a theoretical reference for the design of timing strategy to defend APT attack intelligently and efficient.

Cyber-attacks occur frequently within the Internet, and the forms of occurrence are ever-changing. In simple terms, attacks are divided into single-step attacks and APT attacks. For the two types of attack, this paper is based on the corresponding attack analysis model: diamond model and kill-chain model, respectively analyze single-step attacks and APT attacks. First, the commonality of each type of attack is obtained by analyzing the above models, and then, according to the commonality, list the characteristics of each stage of the known attack on the network. Therefore, the cyber-security status knowledge base is obtained. This knowledge base is part of the cyber-security knowledge graph. Thence, the first and most important thing that must be done is to build cyber-security knowledge graph. By emulating the attacks and collecting data on the simulation platform, the collected data is subjected to pre-processing such as fusion and de-redundancy, the security status features of different hosts at each moment are obtained. Match these network security status features with the cyber-security knowledge graph, correlate the security status of different hosts, and obtain the security status of the entire network. At the same time, utilize the trigger mechanism of the finite-state machine, and the fault tolerance mechanism is added in the matching process to ensure the accuracy of the analysis results and reduce false positives and false positives.

APT attacks’ forecasts and warning technologies are the most effective strategy to detect and analyze pre-attack indicators. Here, a study on a quantification framework for threatening conditions is necessary to being able to extract various network threatening elements. In this study, we collected data on security threatening elements to analyze network threatening elements. We analyzed the limitations of pre-technologies to analyze the quantification technologies of pre-threatening conditions. We also categorized their degrees of risks by grading threatening elements to deduce a method of graded degrees of risks.

Effective method for detecting malicious PowerShell scripts based on hybrid features☆

Defending Against APT Attacks in Robots: A Multi-phase Game-Theoretical Approach

Decoding the Human Element in APT Attacks: Unveiling Attention Diversion Techniques in Cyber-Physical System Security

With the development of Internet technology, there are more and more network attack modes. APT attacks, as one of them, will have a very serious impact due to its concealment, long-term nature, and purpose. Fast-flux botnets are widely used in APT attacks due to their spreading power and destructive power. This article first introduces the basic structure and related knowledge of FFSNs, and then summarizes and compares the previous papers on Fast-flux botnet research. In order to effectively detect the Fast-flux botnet, this experiment removed features that require a lot of resources and uncertain factors, and adopted a more convenient feature AA, which became a more lightweight detection model. At the same time, because the automatic update module of the detection system will promptly feedback the current traffic situation in the network, it will greatly improve the accuracy. The experimental results of the CTU-13 and ISOT public data sets show that the detection method proposed in this article Compared with other methods, the accuracy rate is increased to 98%.

The threats to privacy and security have received increasing attention as ubiquitous healthcare applications over the internet become more prevalent, mobile and universal. In particular, we address the communication security issues of access sharing of health information resources for threats of APT attack decrease in the ubiquitous healthcare environment. The proposed scheme resolves the sender and data authentication problem in information systems and group communications. We propose a novel key management scheme for generating and distributing cryptographic keys to constituent users to provide form of data encryption method for certain types of data concerning resource constraints for preparatory secure communications to APT attack in the ubiquitous healthcare domains.

By studying the known APT attack events deeply, this paper propose a feature selection method of APT sample and a logic expression generation algorithm IOCG (Indicator of Compromise Generate). The algorithm can automatically generate machine readable IOCs (Indicator of Compromise), to solve the existing IOCs logical relationship is fixed, the number of logical items unchanged, large scale and cannot generate a sample of the limitations of the expression. At the same time, it can reduce the redundancy and useless APT sample processing time consumption, and improve the sharing rate of information analysis, and actively respond to complex and volatile APT attack situation. The samples were divided into experimental set and training set, and then the algorithm was used to generate the logical expression of the training set with the IOC_ Aware plug-in. The contrast expression itself was different from the detection result. The experimental results show that the algorithm is effective and can improve the detection effect.

Cybercrimes and cyber-terror attacks disturb national order, and can result in cyber warfare that ruins people's happiness, and destroys national security and people's safety. Cyber-terror attacks have occurred in the 7.7 DDoS attack, the 3.4 DDoS attack, the attack that paralyzed the NH Computer Network, the Jungang Ilbo Incident, The APT attack against KBS, MBC, YTN, the Shinhan Bank, and the NH Bank to stop computer operation. In 2013, the website of Cheongwadae was attacked through the 6.25 cyber- terror attack. In January, 2014, confidential personal information of approximately 85 million customers of 3 credit card companies of the Lotte Card, KB Kookmin Card and the NH Card was stolen. There is a need for real-time response system that can respond in real-time cyber-hacking attacks. However, acts and regulations are insufficient, the budget and the policies and institutions of national cyber security is needed to support the organization. In this study, we analyze and compare the two Cyber-terro Prevention Act was proposed to the National Assembly. And, triggered alarm in the control tower and cyber need for cyber security against cyber crisis. Keywords: Cybersecurity, Cyber-terror, Hacking. National Cybersecurity, Prevention Act