On Preempting Advanced Persistent Threats Using Probabilistic Graphical Models

Abstract

This paper presents PULSAR, a framework for preempting Advanced Persistent Threats (APTs). PULSAR employs a probabilistic graphical model (specifically a Factor Graph) to infer the time evolution of an attack based on observed security events at runtime. The framework (i) learns the statistical significance of patterns of events from past attacks; (ii) composes these patterns into FGs to capture the progression of the attack; and (iii) decides on preemptive actions. The accuracy of our approach and its performance are evaluated in three experiments at SystemX: (i) a study with a dataset containing 120 successful APTs over the past 10 years (PULSAR accurately identifies 91.7%); (ii) replaying of a set of ten unseen APTs (PULSAR stops 8 out of 10 replayed attacks before system integrity violation, and all ten before data exfiltration); and (iii) a production deployment of the framework (during a month-long deployment, PULSAR took an average of one second to make a decision).

RANK: AI-assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networks

“…Besides their visually attractive properties, the topology of a directed graph is a representation of the attack plan progression. In such graphs, each vertex represents an individual alert, which might come from a variety of security solutions, and each edge represents the progression between two alerts [8]. With their vertices comprised of security alerts, attack graphs are also sometimes called alert graphs, which is the terminology we use in this work.…”

“…However, this approach requires heavy manual work, and can not handle cases when multiple attacks are carried-out simultaneously. Finally, in [8] a separate graph is defined for each single asset. This approach results in manageable graphs, but it ignores lateral movement between assets, a common tactic in APT attacks.…”

“…A pattern is emerging in the literature where the detection of APTs is composed of numerous small and simple detectors each focused on a single step in the APT chain. Examples of this methodology are [7], [8]. These small detectors are based on either signature-based intrusion detection systems (IDS), user entity behavior analytics (UEBA) [9], or a combination of both.…”