Visible to the public "Advanced Persistent Threats - detection and defense"Conflict Detection Enabled

Title"Advanced Persistent Threats - detection and defense"
Publication TypeConference Paper
Year of Publication2015
AuthorsJ. Vukalović, D. Delija
Conference Name2015 38th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)
Date PublishedMay
ISBN Number978-9-5323-3082-3
Accession Number15305186
KeywordsAccess Control, advanced persistent threats, anomaly detection, attack vectors, authorisation, command and control systems, computer systems, cryptography, data mining, data protection, Encryption, Malware, Monitoring, Organizations, pubcrawl170101, security policies, security upgrades, Servers, software IDS tools

The term "Advanced Persistent Threat" refers to a well-organized, malicious group of people who launch stealthy attacks against computer systems of specific targets, such as governments, companies or military. The attacks themselves are long-lasting, difficult to expose and often use very advanced hacking techniques. Since they are advanced in nature, prolonged and persistent, the organizations behind them have to possess a high level of knowledge, advanced tools and competent personnel to execute them. The attacks are usually preformed in several phases - reconnaissance, preparation, execution, gaining access, information gathering and connection maintenance. In each of the phases attacks can be detected with different probabilities. There are several ways to increase the level of security of an organization in order to counter these incidents. First and foremost, it is necessary to educate users and system administrators on different attack vectors and provide them with knowledge and protection so that the attacks are unsuccessful. Second, implement strict security policies. That includes access control and restrictions (to information or network), protecting information by encrypting it and installing latest security upgrades. Finally, it is possible to use software IDS tools to detect such anomalies (e.g. Snort, OSSEC, Sguil).

Citation Key7160480