Heterogeneous Provenance Graph Learning Model Based APT Detection
APT(advanced persistent threat)are advanced persistent cyber-attack by hacker organizations to breach the target information system.Usually,the APTs are characterized by long duration and multiple attack techniques,making the traditional intrusion detection methods ineffective.Most existing APT dete...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | zho |
| Published: |
Editorial office of Computer Science
2023-04-01
|
| Series: | Jisuanji kexue |
| Subjects: | |
| Online Access: | https://www.jsjkx.com/fileup/1002-137X/PDF/1002-137X-2023-50-4-359.pdf |
| _version_ | 1797845061928484864 |
|---|---|
| author | DONG Chengyu, LYU Mingqi, CHEN Tieming, ZHU Tiantian |
| author_facet | DONG Chengyu, LYU Mingqi, CHEN Tieming, ZHU Tiantian |
| author_sort | DONG Chengyu, LYU Mingqi, CHEN Tieming, ZHU Tiantian |
| collection | DOAJ |
| description | APT(advanced persistent threat)are advanced persistent cyber-attack by hacker organizations to breach the target information system.Usually,the APTs are characterized by long duration and multiple attack techniques,making the traditional intrusion detection methods ineffective.Most existing APT detection systems are implemented based on manually designed rules by referring to domain knowledge(e.g.,ATT&CK).However,this way lacks of intelligence,generalization ability,and is difficult to detect unknown APT attacks.Aiming at this limitation,this paper proposes an intelligent APT detection method based on provenance data and graph neural networks.To capture the rich context information in the diversified attack techniques of APTs,it firstly models the system entities(e.g.,process,file,socket)in the provenance data into a provenance graph,and learns a semantic vector representation for each system entity by heterogeneous graph learning model.Then,to solve the problem of graph scale explosion caused by the long-term behaviors of APTs,APT detection is performed by sampling a local graph from the large scale heterogeneous graph,and classifying the key system entities as malicious or benign by graph convolution networks.A series of experiments are conducted on two datasets with real APT attacks.Experiment results show that the comprehensive performance of the proposed method outperforms other learning based detection models,as well as the state-of-the-art rule based APT detection systems. |
| first_indexed | 2024-04-09T17:32:25Z |
| format | Article |
| id | doaj.art-59ba56002c9c48db8ab588ec20ad312d |
| institution | Directory Open Access Journal |
| issn | 1002-137X |
| language | zho |
| last_indexed | 2024-04-09T17:32:25Z |
| publishDate | 2023-04-01 |
| publisher | Editorial office of Computer Science |
| record_format | Article |
| series | Jisuanji kexue |
| spelling | doaj.art-59ba56002c9c48db8ab588ec20ad312d2023-04-18T02:33:33ZzhoEditorial office of Computer ScienceJisuanji kexue1002-137X2023-04-0150435936810.11896/jsjkx.220300040Heterogeneous Provenance Graph Learning Model Based APT DetectionDONG Chengyu, LYU Mingqi, CHEN Tieming, ZHU Tiantian0College of Computer Science & Technology,Zhejiang University of Technology,Hangzhou 310023,ChinaAPT(advanced persistent threat)are advanced persistent cyber-attack by hacker organizations to breach the target information system.Usually,the APTs are characterized by long duration and multiple attack techniques,making the traditional intrusion detection methods ineffective.Most existing APT detection systems are implemented based on manually designed rules by referring to domain knowledge(e.g.,ATT&CK).However,this way lacks of intelligence,generalization ability,and is difficult to detect unknown APT attacks.Aiming at this limitation,this paper proposes an intelligent APT detection method based on provenance data and graph neural networks.To capture the rich context information in the diversified attack techniques of APTs,it firstly models the system entities(e.g.,process,file,socket)in the provenance data into a provenance graph,and learns a semantic vector representation for each system entity by heterogeneous graph learning model.Then,to solve the problem of graph scale explosion caused by the long-term behaviors of APTs,APT detection is performed by sampling a local graph from the large scale heterogeneous graph,and classifying the key system entities as malicious or benign by graph convolution networks.A series of experiments are conducted on two datasets with real APT attacks.Experiment results show that the comprehensive performance of the proposed method outperforms other learning based detection models,as well as the state-of-the-art rule based APT detection systems.https://www.jsjkx.com/fileup/1002-137X/PDF/1002-137X-2023-50-4-359.pdfapt detection|graph neural network|provenance graph|hosted-based security|data-driven security |
| spellingShingle | DONG Chengyu, LYU Mingqi, CHEN Tieming, ZHU Tiantian Heterogeneous Provenance Graph Learning Model Based APT Detection Jisuanji kexue apt detection|graph neural network|provenance graph|hosted-based security|data-driven security |
| title | Heterogeneous Provenance Graph Learning Model Based APT Detection |
| title_full | Heterogeneous Provenance Graph Learning Model Based APT Detection |
| title_fullStr | Heterogeneous Provenance Graph Learning Model Based APT Detection |
| title_full_unstemmed | Heterogeneous Provenance Graph Learning Model Based APT Detection |
| title_short | Heterogeneous Provenance Graph Learning Model Based APT Detection |
| title_sort | heterogeneous provenance graph learning model based apt detection |
| topic | apt detection|graph neural network|provenance graph|hosted-based security|data-driven security |
| url | https://www.jsjkx.com/fileup/1002-137X/PDF/1002-137X-2023-50-4-359.pdf |
| work_keys_str_mv | AT dongchengyulyumingqichentiemingzhutiantian heterogeneousprovenancegraphlearningmodelbasedaptdetection |