Exploring the vulnerability in the inference phase of advanced persistent threats

Qi, Wu; Li, Qiang; Guo, Dong; Meng, Xiangyu

doi:10.1177/15501329221080417

Cited by 4 publications

(3 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…APT28 has used botnets both for OPSEC and C2 purposes [139], particularly when targeting IoT devices [140]. Also regarding C2, APT28 has registered domain names and rented VPS to host these domains as web infrastructure [141] [137] [142] [143] [144] [145] [146] [136].…”

Section: Apt28mentioning

confidence: 99%

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

Villalon-huerta,

Ripoll-ripoll,

Marco-gisbert

2024

International Journal of Information Security Science

View full text Add to dashboard Cite

Advanced threat actors conduncting operations in cyberspace require the utilization of external infrastructure. This referes to elements of infrastructure available on the Internet, situated outside the target’s own premises. The analysis of this infrastructure and the techniques employed to bring it to full operational capacity constitute a pivotal factor in characterizing threat actors and their operations. However, the majority of the existing scientific and technical literature found focuses on internal infrastructure elements, particularly on malware implants, as well as on the tactics and techniques employed by the threat actor within their victim’s infrastructure. In this work a comprehensive analysis of this external infrastructure and its provisioning techniques is presented. While our research has primarily concentrated on Russian APT groups and their operations, our findings are equally applicable to all advanced groups and operations. The outcomes of our study can greatly assist analysts in characterizing these groups and their operations, especially with regards to attribution efforts. Our proposal follows a logical structure that can be easy to expand and adapt, and it can be used to improve commonly accepted industry standards such as MITRE ATT&CK.

show abstract

Section: Apt28mentioning

confidence: 99%

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

Villalon-huerta,

Ripoll-ripoll,

Marco-gisbert

2024

International Journal of Information Security Science

View full text Add to dashboard Cite

show abstract

“…Moreover, Ref. [174] presents an algorithm for generating adversarial examples in the APT domain. The algorithm was successfully utilized to execute a gray-box attack on an APT detection model.…”

Section: Ai Techniques/algorithms Used To Detect Apts In Personal Com...mentioning

confidence: 99%

A Systematic Literature Review and a Conceptual Framework Proposition for Advanced Persistent Threats (APT) Detection for Mobile Devices Using Artificial Intelligence Techniques

2023

View full text Add to dashboard Cite

Advanced persistent threat (APT) refers to a specific form of targeted attack used by a well-organized and skilled adversary to remain undetected while systematically and continuously exfiltrating sensitive data. Various APT attack vectors exist, including social engineering techniques such as spear phishing, watering holes, SQL injection, and application repackaging. Various sensors and services are essential for a smartphone to assist in user behavior that involves sensitive information. Resultantly, smartphones have become the main target of APT attacks. Due to the vulnerability of smartphone sensors, several challenges have emerged, including the inadequacy of current methods for detecting APTs. Nevertheless, several existing APT solutions, strategies, and implementations have failed to provide comprehensive solutions. Detecting APT attacks remains challenging due to the lack of attention given to human behavioral factors contributing to APTs, the ambiguity of APT attack trails, and the absence of a clear attack fingerprint. In addition, there is a lack of studies using game theory or fuzzy logic as an artificial intelligence (AI) strategy for detecting APT attacks on smartphone sensors, besides the limited understanding of the attack that may be employed due to the complex nature of APT attacks. Accordingly, this study aimed to deliver a systematic review to report on the extant research concerning APT detection for mobile sensors, applications, and user behavior. The study presents an overview of works performed between 2012 and 2023. In total, 1351 papers were reviewed during the primary search. Subsequently, these papers were processed according to their titles, abstracts, and contents. The resulting papers were selected to address the research questions. A conceptual framework is proposed to incorporate the situational awareness model in line with adopting game theory as an AI technique used to generate APT-based tactics, techniques, and procedures (TTPs) and normal TTPs and cognitive decision making. This framework enhances security awareness and facilitates the detection of APT attacks on smartphone sensors, applications, and user behavior. It supports researchers in exploring the most significant papers on APTs related to mobile sensors, services, applications, and detection techniques using AI.

show abstract

“…In the context of the rapid development of the Internet, China's network technology is gradually progressing, and various advanced servers have emerged as the times require, playing an irreplaceable role in finance, entertainment, social networking and other fields [1][2][3]. The cloud server is a new type of efficient server, which can flexibly handle computing tasks and has high overall stability.…”

Section: Introductionmentioning

confidence: 99%

Research on cloud server double end vulnerability detection based on heuristic genetic algorithm

Lu,

Cen,

Ren

et al. 2023

Third International Conference on Advanced Algorithms and Signal Image Processing (AASIP 2023)

View full text Add to dashboard Cite

Conventional cloud server dual end vulnerability detection methods mainly use P2P (peer-to-peer) structure to generate dual end vulnerability detection programs, which are vulnerable to the dual identities of the server and the client, resulting in relatively high vulnerability detection errors. Therefore, a new cloud server dual end vulnerability detection method needs to be designed based on heuristic genetic algorithm. That is to say, the heuristic genetic algorithm is used to build a cloud server dual end vulnerability detection model, and the cloud server dual end vulnerability detection middleware is designed, thus realizing the cloud server dual end vulnerability detection. The experimental results show that the designed dual end vulnerability detection method for cloud server based on heuristic genetic algorithm has low relative error of vulnerability detection, which proves that the designed vulnerability detection method has good detection effect, reliability, and certain application value, and has made certain contributions to improving the security of cloud server operation.

show abstract

Exploring the vulnerability in the inference phase of advanced persistent threats

Cited by 4 publications

References 26 publications

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

Provisioning the external infrastructure for Cyberspace Operations. A spotlight on Russian APT groups

A Systematic Literature Review and a Conceptual Framework Proposition for Advanced Persistent Threats (APT) Detection for Mobile Devices Using Artificial Intelligence Techniques

Research on cloud server double end vulnerability detection based on heuristic genetic algorithm

Contact Info

Product

Resources

About