HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows

Abstract

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker's actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-response operations.

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

“…Static models cannot capture dynamic behavior of long-running systems [53], while dynamic modeling during runtime risks poisoning from the attackers [83]. L4 : Provenance graphs are stored and analyzed only in memory, sacrificing long-term scalability [83], [87].…”

“…However, it does not mean that UNICORN forgets informative execution history; rather, UNICORN uses information flow dependencies in the graph to keep up-to-date important, relevant context information. Attackers can slowly penetrate the victim system in an APT, hoping that a time-based IDS eventually forgets this initial attack, but they cannot break the information flow dependencies that are essential to the success of the attack [87]. 3 Periodically, computes a fixed-size graph sketch.…”

“…The experiment simulated an enterprise setup [87] including security-critical services such as a web server, an SSH server, an Email server, and an SMB server (for shared file access). The red team carried out various nation-state and common threats through the use of, e.g., a Firefox backdoor, a Nginx backdoor, and phishing emails.…”

“…More recent work [15], [19], [83], [87] suggests that data provenance might be a better data source for APT detection. Data provenance represents system execution as a directed acyclic graph (DAG) that describes information flow between system subjects (e.g., processes) and objects (e.g., files and sockets).…”

“…However, practical computational constraints limit the scope of the contextual analysis that is feasible. Thus, current systems suffer from some combination of the following three problems: 1) static models cannot capture long term system behavior, 2) the lowand-slow APT approach can gradually poison dynamic models, and 3) approaches that require in-memory computation [83], [87] scale poorly in the presence of long-running attacks [87].…”