From TTP to IoC: Advanced Persistent Graphs for Threat Hunting - Archive ouverte HAL Access content directly
Journal Articles IEEE Transactions on Network and Service Management Year : 2021

From TTP to IoC: Advanced Persistent Graphs for Threat Hunting

(1) , (2) , (1) , (1)
1
2

Abstract

Defenders fighting against Advanced Persistent Threats need to discover the propagation area of an adversary as quickly as possible. This discovery takes place through a phase of an incident response operation called Threat Hunting, where defenders track down attackers within the compromised network. In this article, we propose a formal model that dissects and abstracts elements of an attack, from both attacker and defender perspectives. This model leads to the construction of two persistent graphs on a common set of objects and components allowing for (1) an omniscient actor to compare, for both defender and attacker, the gap in knowledge and perceptions; (2) the attacker to become aware of the traces left on the targeted network; (3) the defender to improve the quality of Threat Hunting by identifying false-positives and adapting logging policy to be oriented for investigations. In this article, we challenge this model using an attack campaign mimicking APT29, a real-world threat, in a scenario designed by the MITRE Corporation. We measure the quality of the defensive architecture experimentally and then determine the most effective strategy to exploit data collected by the defender in order to extract actionable Cyber Threat Intelligence, and finally unveil the attacker.
Fichier principal
Vignette du fichier
Final version TNSM - From TTP to IoC - Advanced Persistent Graphs for Threat Hunting.pdf (3.14 Mo) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03131262 , version 1 (04-02-2021)

Identifiers

Cite

Aimad Berady, Mathieu Jaume, Valérie Viet Triem Tong, Gilles Guette. From TTP to IoC: Advanced Persistent Graphs for Threat Hunting. IEEE Transactions on Network and Service Management, 2021, Special Issue on Latest Developments for Security Management of Networks and Services, 18 (2), pp.1321 - 1333. ⟨10.1109/TNSM.2021.3056999⟩. ⟨hal-03131262⟩
797 View
788 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More