HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows

2018/10/03 by Sadegh M. Milajerdi, Milajerdi, Sadegh M., Rigel Gjomemo +7 · 26 citations
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.1810.01594

openalex publication_date 2018/10/03 · openalex created_date 2018/10/12 · openalex updated_date 2026/07/28

Abstract

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a nutshell, HOLMES aims to produce a detection signal that indicates the presence of a coordinated set of activities that are part of an APT campaign. One of the main challenges addressed by our approach involves developing a suite of techniques that make the detection signal robust and reliable. At a high-level, the techniques we develop effectively leverage the correlation between suspicious information flows that arise during an attacker campaign. In addition to its detection capability, HOLMES is also able to generate a high-level graph that summarizes the attacker's actions in real-time. This graph can be used by an analyst for an effective cyber response. An evaluation of our approach against some real-world APTs indicates that HOLMES can detect APT campaigns with high precision and low false alarm rate. The compact high-level graphs produced by HOLMES effectively summarizes an ongoing attack campaign and can assist real-time cyber-response operations.

Cited by

• PROVEX: Enhancing SOC Analyst Trust with Explainable Provenance-Based IDS
• The Procedural Semantics Gap in Structured CTI: A Measurement-Driven STIX Analysis for APT Emulation
• SecTracer: A Framework for Uncovering the Root Causes of Network Intrusions via Security Provenance
• A Survey of Heterogeneous Graph Neural Networks for Cybersecurity Anomaly Detection
• TGCM: Topic-Guided Consistency Modeling for One-Step Disentanglement of Interleaved APT Technique Sequences
• ProGQL: A Provenance Graph Query System for Cyber Attack Investigation
• TPPR: APT Tactic / Technique Pattern Guided Attack Path Reasoning for Attack Investigation
• AegisMCP: Online Graph Intrusion Detection for Tool-Augmented LLMs on Edge Devices
• OCR-APT: Reconstructing APT Stories from Audit Logs using Subgraph Anomaly Detection and LLMs
• RHINO: Guided Reasoning for Mapping Network Logs to Adversarial Tactics and Techniques with Large Language Models
• Ancora: Accurate Intrusion Recovery for Web Applications
• DeepProv: Behavioral Characterization and Repair of Neural Networks via Inference Provenance Graph Analysis
• Cybersecurity Detection Classification with Reasoning-enabled Language Models
• A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends
• KnowHow: Automatically Applying High-Level CTI Knowledge for Interpretable and Accurate Provenance Analysis
• Insight-LLM: LLM-enhanced Multi-view Fusion in Insider Threat Detection
• An Automated Attack Investigation Approach Leveraging Threat-Knowledge-Augmented Large Language Models
• LLM-driven Provenance Forensics for Threat Investigation and Detection
• DEFENDCLI: Command-Line Driven Attack Provenance Examination
• MirGuard: Towards a Robust Provenance-based Intrusion Detection System Against Graph Manipulation Attacks
• ProvX: Generating Counterfactual-Driven Attack Explanations for Provenance-Based Detection
• From Alerts to Intelligence: A Novel LLM-Aided Framework for Host-based Intrusion Detection
• CLIProv: A Contrastive Log-to-Intelligence Multimodal Approach for Threat Detection and Provenance Analysis
• SmartGuard: Leveraging Large Language Models for Network Attack Detection through Audit Log Analysis and Summarization
• Few-Shot Learning-Based Cyber Incident Detection with Augmented Context Intelligence
• Sharpening Kubernetes Audit Logs with Context Awareness

Related

• SHIELD: APT Detection and Intelligent Explanation Using LLM
• Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data
• RANK: AI-assisted End-to-End Architecture for Detecting Persistent Attacks in Enterprise Networks
• AI-Driven Cybersecurity Threat Detection: Building Resilient Defense Systems Using Predictive Analytics
• Prov2vec: Learning Provenance Graph Representation for Unsupervised APT Detection