As Advanced Persistent Threats (APTs) grow increasingly sophisticated, the demand for effective detection methods has intensified. This study addresses the challenge of identifying APT campaign attacks through system event logs. A cascading approach, name SFM, combines Technique hunting and APT campaign attribution. Our approach assumes that real-world system event logs contain a vast majority of normal events interspersed with few suspiciously malicious ones and that these logs are annotated with Techniques of MITRE ATT&CK framework for attack pattern recognition. Then, we attribute APT campaign attacks by aligning detected Techniques with known attack sequences to determine the most likely APT campaign. Evaluations on five real-world APT campaigns indicate that the proposed approach demonstrates reliable performance.
Cite
@article{arxiv.2410.22602,
title = {A Cascade Approach for APT Campaign Attribution in System Event Logs: Technique Hunting and Subgraph Matching},
author = {Yi-Ting Huang and Ying-Ren Guo and Guo-Wei Wong and Meng Chang Chen},
journal= {arXiv preprint arXiv:2410.22602},
year = {2024}
}