POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting

By Sadegh M. Milajerdi, Birhanu Eshete, Rigel Gjomemo, Venkat N. Venkatakrishnan. Conference on Computer and Communications Security, 2019

336 citations recorded by the source corpus.

Cyber threat intelligence (CTI) is being used to search for indicators of attacks that might have compromised an enterprise network for a long time without being discovered. To have a more effective analysis, CTI open standards have incorporated descriptive relationships showing how the indicators or observables are related to each other. However, these relationships are either completely overlooked in information gathering or not used for threat hunting. In this paper, we propose a system, called POIROT, which uses these correlations to uncover the steps of a successful attack campaign. We use kernel audits as a reliable source that covers all causal relations and information flows among system entities and model threat hunting as an inexact graph pattern matching problem. Our technical approach is based on a novel similarity metric which assesses an alignment between a query graph constructed out of CTI correlations and a provenance graph constructed out of kernel audit log records. We evaluate POIROT on publicly released real-world incident reports as well as reports of an adversarial engagement designed by DARPA, including ten distinct attack campaigns against different OS platforms such as Linux, FreeBSD, and Windows. Our evaluation results show that POIROT is capable of searching inside graphs containing millions of nodes and pinpoint the attacks in a few minutes, and the results serve to illustrate that CTI correlations could be used as robust and reliable artifacts for threat hunting.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/40d7bed3161095d5d76a8cfea52f9ebe758299d4

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, background): “In recent years, signiﬁcant advancements have been made that improve the ﬁdelity [20], [21], [22], [23], [24], [25], [26], [27], [28] and efﬁciency [29], [30], [31], [32], [33], [34], [35], [36], [37] of causal analysis, and recent results indicate that causal analysis can even be leveraged to…”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “Poirot [86] produces another form of attack reconstruction.”