APT Detection via Event Correlation on Private Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional solutions for detecting network intrusions and malware are ineffective against advanced persistent threats (APT) as APT attacks often involve normal or authorized network activities, making them difficult to detect, particularly during stages like lateral movement and data discovery.
Innovation Solution
A system comprising network sensors that monitor and process network traffic to identify access events to critical assets, correlating event data using alert rules to detect APT attacks, including pseudo code for identifying anomalous access patterns indicative of lateral movement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection methods are used, then detection of obvious attacks is possible, but detection of APT attacks is ineffective because APT attacks involve normal or authorized network activities
Solution Approach 1:
The system segments the detection approach by separating obvious attack detection from subtle APT detection. It uses multiple detection components including signature-based detection for known threats and anomaly-based detection for APT activities, allowing each component to specialize in different attack types without interfering with the other
Solution Approach 2:
The system changes detection parameters dynamically by adjusting sensitivity thresholds and correlation rules based on the type of attack being detected. For APT detection, it uses lower thresholds for individual events but applies higher-level correlation rules to identify patterns, whereas traditional attacks trigger immediate alerts at higher individual event thresholds
2Measurement precision
If the system monitors all network traffic to detect APT attacks, then detection accuracy improves, but system complexity and processing requirements increase
Solution Approach 1:
The system extracts only the critical elements needed for APT detection by focusing on specific event types (authentication events, access control events, system log events) rather than analyzing all network traffic. It extracts relevant features from these events and applies correlation rules only to these extracted elements, reducing processing complexity while maintaining detection accuracy
Solution Approach 2:
The system adds a temporal dimension to detection by analyzing sequences of events over time rather than individual isolated events. It correlates events across multiple time points and sources to identify APT attack patterns, transforming the detection problem from spatial analysis of single events to temporal analysis of event sequences
3Reliability
If the system correlates multiple event data using alert rules to detect APT attacks, then false positives are reduced, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by pre-defining correlation rules and event patterns that are known to indicate APT attacks. During operation, it quickly matches incoming events against these pre-established rules rather than performing complex real-time analysis, reducing processing time while maintaining high reliability through the use of battle-tested correlation logic
Data Source
AI summary
A system for detecting an advanced persistent threat (APT) attack on a private computer network includes hosts computers that receive network traffic and process the network traffic to identify an access event that indicates access to a critical asset of an organization that owns or maintains the private computer network. The critical asset may be a computer that stores confidential data of the organization. Access events may be stored in an event log as event data. Access events indicated in the event log may be correlated using a set of alert rules to identify an APT attack.