OMMA: open architecture for Operator-guided Monitoring of Multi-step Attacks

Abstract

Current attacks are complex and stealthy. The recent WannaCry malware campaign demonstrates that this is true not only for targeted operations, but also for massive attacks. Complex attacks can only be described as a set of individual actions composing a global strategy. Most of the time, different devices are involved in the same attack scenario. Information about the events recorded in these devices can be collected in the shape of logs in a central system, where an automatic search of threat traces can be implemented. Much has been written about automatic event correlation to detect multi-step attacks but the proposed methods are rarely brought together in the same platform. In this paper, we propose OMMA (Operator-guided Monitoring of Multi-step Attacks), an open and collaborative engineering system which offers a platform to integrate the methods developed by the multi-step attack detection research community. Inspired by a HuMa access (Navarro et al., HuMa: A multi-layer framework for threat analysis in a heterogeneous log environment, 2017) and Knowledge and Information Logs-based System (Legrand et al., Vers une architecture «big-data» bio-inspirée pour la détection d'anomalie des SIEM, 2014) systems, OMMA incorporates real-time feedback from human experts, so the integrated methods can improve their performance through a learning process. This feedback loop is used by Morwilog, an Ant Colony Optimization-based analysis engine that we show as one of the first methods to be integrated in OMMA.

A systematic literature review for APT detection and Effective Cyber Situational Awareness (ECSA) conceptual model

“…Other studies used statistical analysis–based detection models, which have problems in areas such as time and accuracy; for examples of these studies, see Refs. [ 65 , 68 , 69 , 73 , 85 , 87 , 99 , 111 , 116 , 127 ].…”

Alert-driven Attack Graph Generation using S-PDFA

“…Learning From Observables. Cyber data from prior security incidents can be utilized to gain insights into attacker behavior, e.g., using log data [35], [36], [37], sensor data [38], and network traffic [39]. Process mining and Markov models are particularly well-suited for sequential learning problems.…”

Enabling Visual Analytics via Alert-driven Attack Graphs

“…ML application is challenging. In recent years, machine learning (ML) has emerged as a promising solution for obtaining insights into attacker behavior [6,9,11,12]. ML application requires that the following three challenges be addressed:…”