NetworkTrace: Probabilistic Relevant Pattern Recognition Approach to Attribution Trace Analysis

Xu, Jian; Yun, Xiaochun; Zhang, Yongzheng; Sang, Yafei; Cheng, Zhenyu

doi:10.1109/trustcom/bigdatase/icess.2017.301

Cited by 3 publications

(2 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Karafili et al [15] developed an automated argumentation-based reasoner using both technical and social evidence. Xu et al [16] proposed a dependence probability algorithm to analyze and quantify the correlation between network attack traces. However, these methods heavily rely on pre-defined feature sets or association rules based on expert knowledge, which may not adapt well to the dynamic changes in the network environment.…”

Section: Apt Group Correlation Analysismentioning

confidence: 99%

See 1 more Smart Citation

Advanced Persistent Threat Group Correlation Analysis via Attack Behavior Patterns and Rough Sets

Li,

Liu,

Zhang

2024

Electronics

View full text Add to dashboard Cite

In recent years, advanced persistent threat (APT) attacks have become a significant network security threat due to their concealment and persistence. Correlation analysis of APT groups is vital for understanding the global network security landscape and accurately attributing threats. Current studies on threat attribution rely on experts or advanced technology to identify evidence linking attack incidents to known APT groups. However, there is a lack of research focused on automatically discovering potential correlations between APT groups. This paper proposes a method using attack behavior patterns and rough set theory to quantify APT group relevance. It extracts two types of features from threat intelligence: APT attack objects and behavior features. To address the issues of inconsistency and limitations in threat intelligence, this method uses rough set theory to model APT group behavior and designs a link prediction method to infer correlations among APT groups. Experimental results on publicly available APT analysis reports show a correlation precision of 90.90%. The similarity coefficient accurately reflects the correlation strength, validating the method’s efficacy and accuracy.

show abstract

Section: Apt Group Correlation Analysismentioning

confidence: 99%

“…Few studies have focused on analyzing the correlations between APT groups. Some methods [13][14][15][16] explore correlations between attack behaviors to uncover associations between incidents. However, individual incident relevance is subject to change and does not fully represent APT group attack patterns.…”

Section: Introductionmentioning

confidence: 99%