Advanced threat intelligence: detection and classification of anomalous behavior in system processes

Abstract

With the advent of Advanced Persistent Threats (APTs), it has become increasingly difficult to identify and understand attacks on computer systems. This paper presents a system capable of explaining anomalous behavior within network-enabled user sessions by describing and interpreting kernel event anomalies detected by their deviation from normal behavior.The prototype has been developed at the Josef Ressel Center for Unified Threat Intelligence on Targeted Attacks (TARGET) at St. Pölten University of Applied Sciences. Advanced Threat Intelligence: Erkennung und Klassifizierung von anomalem Verhalten in Systemprozessen. Mit dem Aufkommen von Advanced Persistent Threats (APTs) ist es immer schwieriger geworden, Angriffe aufComputersysteme zu identifizieren und zu verstehen. Diese Arbeit stellt ein System vor, das in der Lage ist, anomales Verhalten innerhalb von Benutzer-Sessions zu erklären, indem es Kernel-Ereignisanomalien beschreibt und klassifiziert, welche durch ihre Abweichung vom Normalverhalten erkannt werden. Der Prototyp wurde am Josef Ressel-Zentrum für konsolidierte Erkennung gezielter Angriffe (TARGET) an der Fachhochschule St. Pölten entwickelt.

SK-Tree: a systematic malware detection algorithm on streaming trees via the signature kernel

“…Process trees were further studied in [17], where structures from process trees were compared against reference trees known to be nonmalicious. A similar technique was used by [18], comparing star structures with templates extracted from uninfected trees. However, none of the aforementioned approaches are designed to process complex data structures that are hierarchical and sequential simultaneously.…”