• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>International Conference on Cyber Security and Protection of Digital Services >Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques - An Experiment
【24h】

Towards Identifying Human Actions, Intent, and Severity of APT Attacks Applying Deception Techniques - An Experiment

机译：运用欺骗手段识别APT攻击的人为行为，意图和严重性-实验

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Attacks by Advanced Persistent Threats (APTs) have been shown to be difficult to detect using traditional signature- and anomaly-based intrusion detection approaches. Deception techniques such as decoy objects, often called honey items, may be deployed for intrusion detection and attack analysis, providing an alternative to detect APT behaviours. This work explores the use of honey items to classify intrusion interactions, differentiating automated attacks from those which need some human reasoning and interaction towards APT detection. Multiple decoy items are deployed on honeypots in a virtual honey network, some as breadcrumbs to detect indications of a structured manual attack. Monitoring functionality was created around Elastic Stack with a Kibana dashboard created to display interactions with various honey items. APT type manual intrusions are simulated by an experienced pentesting practitioner carrying out simulated attacks. Interactions with honey items are evaluated in order to determine their suitability for discriminating between automated tools and direct human intervention. The results show that it is possible to differentiate automatic attacks from manual structured attacks; from the nature of the interactions with the honey items. The use of honey items found in the honeypot, such as in later parts of a structured attack, have been shown to be successful in classification of manual attacks, as well as towards providing an indication of severity of the attacks
机译：已经证明，使用传统的基于特征和异常的入侵检测方法很难检测到高级持续威胁（APT）的攻击。诸如诱饵对象之类的欺骗技术（通常被称为蜜糖物品）可以用于入侵检测和攻击分析，从而提供了一种检测APT行为的替代方法。这项工作探索了使用蜂蜜项目对入侵交互进行分类的方法，从而将自动攻击与那些需要一些人为推理和交互才能进行APT检测的攻击区分开来。在虚拟蜂蜜网络中的蜜罐上部署了多个诱饵物品，有些是面包屑，用于检测结构化手动攻击的迹象。在Elastic Stack周围创建了监视功能，并创建了一个Kibana仪表板来显示与各种蜂蜜项目的交互。 APT类型的手动入侵是由经验丰富的测试专家进行模拟攻击来模拟的。评估与蜂蜜项目的交互作用，以确定它们是否适合区分自动工具和直接的人工干预。结果表明，可以将自动攻击与手动结构化攻击区分开;从与蜂蜜项目的互动性质。已证明，在蜜罐中使用的蜜糖物品（例如在结构化攻击的后期），可以成功地将人工攻击归类，并提供攻击严重程度的指示

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号