.png){kind=icon}
返回
MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning
.png){kind=icon}
PRE
AI
DOI：10.1109/TIFS.2024.3396390.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The stealthy and persistent nature of Advanced Persistent Threats (APTs) makes them one of the most challenging cyber threats to uncover. Several systems adopted the development of provenance-graph-based security solutions to capture this persistent nature. Provenance graphs (PGs) represent system audit logs by connecting system entities using causal relations and information flows. Hunting APTs demands the processing of ever-growing large-scale PGs of audit logs for a wide range of activities over months or years, i.e., multi-terabyte graphs. Existing APT hunting systems are typically memory-based, which suffers colossal memory consumption, or disk-based, which suffers from performance hits. Therefore, these systems are hard to scale in terms of graph size or time performance. In this paper, we propose MEGR-APT, a scalable APT hunting system to discover suspicious subgraphs matching an attack scenario (query graph) published in Cyber Threat Intelligence (CTI) reports. MEGR-APT hunts APTs in a twofold process: (i) memory-efficient extraction of suspicious subgraphs as search queries over a graph database, and (ii) fast subgraph matching based on graph neural network (GNN) and our effective attack representation learning. We compared MEGR-APT with state-of-the-art (SOTA) APT systems using popular APT benchmarks, such as DARPA TC3 and OpTC. We also tested it using a real enterprise dataset. MEGR-APT achieves an order of magnitude reduction in memory consumption while achieving comparable performance to SOTA in terms of time and accuracy.
Keyword:
Representation learning
Memory management
Resource description framework
Load modeling
Cyber threat intelligence
Databases
Costs
GNN-based APT hunting
provenance graphs
期刊
IF:
8
论文数:
5.3K
被引数:
2.3W
机构
引用论文
.png){kind=icon}
分享收藏
Preliminary Study on the Role Played by the Third Liquid Phase in Phase Transfer Catalysis第三液相在相转移催化中作用的初步研究
PREAI
分享收藏
Compelexes de la ferrotetraphenylporphyrine avec des chlorocarbenes porteurs d'un groupement electroattracteur: Fer(II)(TPP)(CClA), A = CN ou COOC2H5四苯基四苯基铁卟啉化合物电子吸引子: Fer(II)(TPP)(CClA)，A = CN ou COOC2H5
PREAI
分享收藏
查看更多内容