HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows

By Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete, R. Sekar, Venkat N. Venkatakrishnan. IEEE Symposium on Security and Privacy, 2018

593 citations recorded by the source corpus.

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker’s actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-response operations.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/92cf40b989d0d6aba4166d7820a304f2a27225e9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems

In Signal Processing

Citations in the corpus

Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise (2019, methodology): “Similarly, there exist other attack scenarios [34].”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, background): “Recent studies have leveraged provenance graphs for different objectives, such as alert triage [24], zero-day attack path identification [61], attack detection and reconstruction [25, 47].”
Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “Note that previous papers [42], [25], [43], [22], [38] on Windows provenance do not capture ALPC messages,”
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats (2020, methodology): “L4 : Provenance graphs are stored and analyzed only in memory, sacrificing long-term scalability [83], [87].”