SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data

By M. Hossain, Sadegh M. Milajerdi, Junao Wang, Birhanu Eshete, Rigel Gjomemo, R. Sekar, S. Stoller, Venkat N. Venkatakrishnan. USENIX Security Symposium, 2018

309 citations recorded by the source corpus.

We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team's attacks on hosts running Windows, FreeBSD and Linux.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/92c6c7ed186cf44bbab8cdf512bf9c0661ac575f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “Note that previous papers [42], [25], [43], [22], [38] on Windows provenance do not capture ALPC messages,”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, methodology): “This is a common representation of kernel audit logs, which allows tracking causality and information flow efficiently [17, 18, 25, 33, 34].”
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, methodology): “We note that a common practice in prior work [22], [28], [34], [39] on attack forensics is to do backward tracking from a TTP matching point to reach an initial compromise point.”
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “However, PROVDETECTOR can be implemented as a real-time approach by using an in-memory provenance graph database on each monitored host [59].”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “for future provenance-based security applications. Recently, as APT attacks become increasingly prominent, a number of systems leverage data provenance for APT attack analysis. Holmes [87] and Sleuth [58] focus primarily on attack reconstruction using information ﬂow provided by data provenance. The”
Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise (2019, background): “Certainly, they can also utilize advanced methods regarding forensics [17, 22, 55].”