Visible to the public Graph-Based APT Detection

TitleGraph-Based APT Detection
Publication TypeConference Paper
Year of Publication2018
AuthorsDebatty, T., Mees, W., Gilon, T.
Conference Name2018 International Conference on Military Communications and Information Systems (ICMCIS)
ISBN Number978-1-5386-4559-8
Keywordsadvanced persistent threats, antiviruses, Approximation algorithms, Batch production systems, Browsers, detection system, graph model, graph theory, graph-based APT detection, HTTP traffic, Human Behavior, Image edge detection, invasive software, malware analysis, Metrics, Organizations, privacy, Protocols, pubcrawl, Resiliency, Servers, undocumented attacks, Web interface

In this paper we propose a new algorithm to detect Advanced Persistent Threats (APT's) that relies on a graph model of HTTP traffic. We also implement a complete detection system with a web interface that allows to interactively analyze the data. We perform a complete parameter study and experimental evaluation using data collected on a real network. The results show that the performance of our system is comparable to currently available antiviruses, although antiviruses use signatures to detect known malwares while our algorithm solely uses behavior analysis to detect new undocumented attacks.

Citation Keydebatty_graph-based_2018