| DOI | Resolve DOI: https://doi.org/10.1007/978-3-031-15777-6_30 |
|---|
| Author | Search for: Mamun, Mohammad1; Search for: Buffett, Scott1 |
|---|
| Affiliation | - National Research Council of Canada. Digital Technologies
|
|---|
| Format | Text, Article |
|---|
| Conference | Information and Communications Security: 24th International Conference, ICICS 2022, September 5–8, 2022, Canterbury, UK |
|---|
| Subject | process tree; behavioral anomaly detection; sequential pattern mining; APT detection |
|---|
| Abstract | Host behaviour modelling is widely deployed in today’s corporate environments to aid in the detection and analysis of cyber attacks. Audit logs containing system-level events are frequently used for behavior modeling as they can provide detailed insight into cyber-threat occurrences. However, mapping low-level system events in audit logs to high-level behaviors has been a major challenge in identifying host contextual behavior for the purpose of detecting potential cyber threats. Relying on domain expert knowledge may limit its practical implementation. This paper presents TapTree, an automated process-tree based technique to extract host behavior by compiling system events’ semantic information. After extracting behaviors as system generated process trees, TapTree integrates event semantics as a representation of behaviors. To further reduce pattern matching workloads for the analyst, TapTree aggregates semantically equivalent patterns and optimizes representative behaviors. In our evaluation against a recent benchmark audit log dataset (DARPA OpTC), TapTree employs tree pattern queries and sequential pattern mining techniques to deduce the semantics of connected system events, achieving high accuracy for behavior abstraction and then Advanced Persistent Threat (APT) attack detection. Moreover, we illustrate how to update the baseline model gradually online, allowing it to adapt to new log patterns over time. |
|---|
| Publication date | 2022-08-24 |
|---|
| Publisher | Springer International Publishing |
|---|
| In | |
|---|
| Series | |
|---|
| Language | English |
|---|
| Peer reviewed | Yes |
|---|
| Export citation | Export as RIS |
|---|
| Report a correction | Report a correction (opens in a new tab) |
|---|
| Record identifier | 96464603-3451-434c-9358-7197364ac54e |
|---|
| Record created | 2022-10-18 |
|---|
| Record modified | 2022-10-21 |
|---|
