2019/05/16 by Aditya Kuppa, Kuppa, Aditya, Sławomir Grzonkowski +5 · 1 voice
Computer Science · #Advanced Malware Detection Techniques #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.1905.07273
openalex publication_date 2019/05/16 · openalex created_date 2022/07/23 · openalex updated_date 2026/07/28
Advanced attack campaigns span across multiple stages and stay stealthy for\nlong time periods. There is a growing trend of attackers using off-the-shelf\ntools and pre-installed system applications (such as \powershell and\n\wmic) to evade the detection because the same tools are also used by\nsystem administrators and security analysts for legitimate purposes for their\nroutine tasks. To start investigations, event logs can be collected from\noperational systems; however, these logs are generic enough and it often\nbecomes impossible to attribute a potential attack to a specific attack group.\nRecent approaches in the literature have used anomaly detection techniques,\nwhich aim at distinguishing between malicious and normal behavior of computers\nor network systems. Unfortunately, anomaly detection systems based on point\nanomalies are too rigid in a sense that they could miss the malicious activity\nand classify the attack, not an outlier. Therefore, there is a research\nchallenge to make better detection of malicious activities. To address this\nchallenge, in this paper, we leverage Group Anomaly Detection (GAD), which\ndetects anomalous collections of individual data points.\n Our approach is to build a neural network model utilizing Adversarial\nAutoencoder (AAE-\α) in order to detect the activity of an attacker who\nleverages off-the-shelf tools and system applications. In addition, we also\nbuild \Behavior2Vec and \Command2Vec sentence embedding deep\nlearning models specific for feature extraction tasks. We conduct extensive\nexperiments to evaluate our models on real-world datasets collected for a\nperiod of two months. The empirical results demonstrate that our approach is\neffective and robust in discovering targeted attacks, pen-tests, and attack\ncampaigns leveraging custom tools.\n