APT Attack Detection Scheme Based on CK Sketch and DNS Traffic
In recent years, Advanced Persistent Threat (APT) attacks against sensors have emerged as a prominent security concern. Due to the low level of protection provided by sensors, APT attack organizations are able to develop intrusion schemes that allow them to infiltrate, attack, lurk, spread, and stea...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-02-01
|
| Series: | Sensors |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1424-8220/23/4/2217 |
| _version_ | 1827755538121752576 |
|---|---|
| author | Defan Xue Yaping Chi Bing Wu Lun Zhao |
| author_facet | Defan Xue Yaping Chi Bing Wu Lun Zhao |
| author_sort | Defan Xue |
| collection | DOAJ |
| description | In recent years, Advanced Persistent Threat (APT) attacks against sensors have emerged as a prominent security concern. Due to the low level of protection provided by sensors, APT attack organizations are able to develop intrusion schemes that allow them to infiltrate, attack, lurk, spread, and steal information from the target over an extended period of time. Through extensive research on the APT attack process and current defense mechanisms, it has been found that analyzing Domain Name Server (DNS) traffic in the communication control phase is an effective way of detecting APT attacks. However, analyzing APT attacks based on traffic usually involves the detection of a vast amount of DNS traffic, and current data preprocessing methods do not scale down data effectively, leading to low detection efficiency. In previous work, most efforts have been focused on calculating the features of request messages or corresponding messages without considering the association between request messages and corresponding messages. To address these issues, we propose a sketch-based APT attack traffic detection scheme. The scheme leverages the sketch structure to count and compress network traffic, improving the efficiency of APT detection. Our work also analyzes the limitations of traditional sketches in network traffic and proposes an improved sketch scheme. In addition, we propose several effective features for detecting APT attacks. We validate and evaluate our solution using 1,088,280 DNS traffic from a lab network and APT suspicious traffic from netresec and contagio, using eight machine learning models. The experimental results show that for the ExtraTrees model, our solution has a processing time of 0.0638 s and an accuracy of 0.97920, reducing the processing time by approximately 50 times and improving detection accuracy by a small margin compared to a dataset without sketch processing. |
| first_indexed | 2024-03-11T08:09:49Z |
| format | Article |
| id | doaj.art-5c14c0ae749f4cfeaacffae4a19b1594 |
| institution | Directory Open Access Journal |
| issn | 1424-8220 |
| language | English |
| last_indexed | 2024-03-11T08:09:49Z |
| publishDate | 2023-02-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Sensors |
| spelling | doaj.art-5c14c0ae749f4cfeaacffae4a19b15942023-11-16T23:11:52ZengMDPI AGSensors1424-82202023-02-01234221710.3390/s23042217APT Attack Detection Scheme Based on CK Sketch and DNS TrafficDefan Xue0Yaping Chi1Bing Wu2Lun Zhao3Beijing Electronic Science and Technology Institute, Beijing 100070, ChinaBeijing Electronic Science and Technology Institute, Beijing 100070, ChinaBeijing Electronic Science and Technology Institute, Beijing 100070, ChinaBeijing Electronic Science and Technology Institute, Beijing 100070, ChinaIn recent years, Advanced Persistent Threat (APT) attacks against sensors have emerged as a prominent security concern. Due to the low level of protection provided by sensors, APT attack organizations are able to develop intrusion schemes that allow them to infiltrate, attack, lurk, spread, and steal information from the target over an extended period of time. Through extensive research on the APT attack process and current defense mechanisms, it has been found that analyzing Domain Name Server (DNS) traffic in the communication control phase is an effective way of detecting APT attacks. However, analyzing APT attacks based on traffic usually involves the detection of a vast amount of DNS traffic, and current data preprocessing methods do not scale down data effectively, leading to low detection efficiency. In previous work, most efforts have been focused on calculating the features of request messages or corresponding messages without considering the association between request messages and corresponding messages. To address these issues, we propose a sketch-based APT attack traffic detection scheme. The scheme leverages the sketch structure to count and compress network traffic, improving the efficiency of APT detection. Our work also analyzes the limitations of traditional sketches in network traffic and proposes an improved sketch scheme. In addition, we propose several effective features for detecting APT attacks. We validate and evaluate our solution using 1,088,280 DNS traffic from a lab network and APT suspicious traffic from netresec and contagio, using eight machine learning models. The experimental results show that for the ExtraTrees model, our solution has a processing time of 0.0638 s and an accuracy of 0.97920, reducing the processing time by approximately 50 times and improving detection accuracy by a small margin compared to a dataset without sketch processing.https://www.mdpi.com/1424-8220/23/4/2217APT attacksketchDNSdeep learningsensor network |
| spellingShingle | Defan Xue Yaping Chi Bing Wu Lun Zhao APT Attack Detection Scheme Based on CK Sketch and DNS Traffic Sensors APT attack sketch DNS deep learning sensor network |
| title | APT Attack Detection Scheme Based on CK Sketch and DNS Traffic |
| title_full | APT Attack Detection Scheme Based on CK Sketch and DNS Traffic |
| title_fullStr | APT Attack Detection Scheme Based on CK Sketch and DNS Traffic |
| title_full_unstemmed | APT Attack Detection Scheme Based on CK Sketch and DNS Traffic |
| title_short | APT Attack Detection Scheme Based on CK Sketch and DNS Traffic |
| title_sort | apt attack detection scheme based on ck sketch and dns traffic |
| topic | APT attack sketch DNS deep learning sensor network |
| url | https://www.mdpi.com/1424-8220/23/4/2217 |
| work_keys_str_mv | AT defanxue aptattackdetectionschemebasedoncksketchanddnstraffic AT yapingchi aptattackdetectionschemebasedoncksketchanddnstraffic AT bingwu aptattackdetectionschemebasedoncksketchanddnstraffic AT lunzhao aptattackdetectionschemebasedoncksketchanddnstraffic |