...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Studies in Informatics and Control >Complementary Approaches to Instructable Agents for Advanced Persistent Threats Detection
【24h】

Complementary Approaches to Instructable Agents for Advanced Persistent Threats Detection

机译：用于高级持续威胁检测的指示剂的互补方法

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Large CSOCs (cybersecurity operation centers) must analyze tens of thousands of security incidents per day. Not only that there are not enough cybersecurity analysts available but the average cost of a cybersecurity analyst keeps going up. This paper presents a novel approach to the detection of APTs (advanced persistent threats), where an expert cybersecurity analyst directly teaches (rather than programs) a cognitive agent how to investigate cybersecurity alerts, as the analyst would teach a student, through explained examples of investigations. It then presents two complementary instantiations of this approach, as implemented in ADONIS (Automating the ATT&CKTM-based Detection Of Novel Network Intrusions System) and CAAPT (Cognitive Agent for APT detection). ADONIS detects adversary's behavior in terms of MITRE's ATT&CK (Adversarial Tactics, Techniques & Common Knowledge), independent of specific malware and tools. It can therefore detect novel intrusions, but is expected to be less efficient because of the multitude of tactics and techniques that can be employed. CAAPT only detects known malware based on combinations of weak IOCs (indicators of compromise) and, as demonstrated by the experimental results, is efficient. Therefore, once a new malware is detected with ADONIS, its IOCs can be identified and CAAPT can be trained to rapidly detect it. This instructable agents approach promises to significantly reduce the cost of operating the CSOCs and improve their detection performance by automating much of the analysts' investigative activity. It increases the probability of detecting intrusion activity and reduces the false positive detections presented to the analysts who can spend their time on more complex tasks and on teaching the agents.
机译：大型CSOC（网络安全运营中心）必须每天分析成千上万的安全事件。不仅有足够的网络安全分析师可用，但网络安全分析师的平均成本一直在上升。本文提出了一种新颖的检测APTS（高级持续威胁）的方法，其中专家网络安全分析师直接教授（而不是计划）认知代理如何调查网络安全警报，因为分析师将学生教学，通过解释的示例调查。然后，它呈现了这种方法的两个互补实例，如在Adonis中实施的（自动化基于ATT和CKTM的新型网络入侵系统的检测）和CAAPT（用于APT检测的认知剂）。阿多尼斯检测仲裁ATT＆CK（对抗策略，技术和共同知识）的对手的行为，独立于特定恶意软件和工具。因此，它可以检测新颖的入侵，但预计由于可以采用的众多策略和技术，预计会减少效率。 CAAPT仅根据实验结果所证明，基于弱IOC的组合检测已知的恶意软件，并且是有效的。因此，一旦使用ADONIS检测到新的恶意软件，可以识别其IOC，并且可以训练CAAPT以快速检测到它。这种可指导的代理方法有望显着降低经营CSOC的成本，并通过自动化大部分分析师的调查活动来改善其检测性能。它增加了检测入侵活动的概率，并减少了可以在更复杂的任务上和教授代理人的分析师提出的假阳性探测。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号