Abstract
Advanced Persistent Threat is a sophisticated, targeted attack. This threat represents a risk to all organisations, specifically if they manage sensitive data or critical infrastructures. Recently, the analysis of these threats has caught the attention of the scientific community. Researchers have studied the behaviour of this threat to create models and tools that allow early detection of these attacks. The use of Artificial Intelligence can help to detect, alert and automatically predict these types of threats and reduce the time the attacker can stay on a network organisation. The objective of this work is a review of the proposed models to identify the tools and methods that they have used.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsNotes
- 1.
Apache Hadoop\(^\mathrm{TM}\) - https://hadoop.apache.org/.
- 2.
Apache Mahout\(^\mathrm{TM}\) - https://mahout.apache.org/.
References
Buczak, A.L., Guven, E.: A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Commun. Surv. Tutorials 18(2), 1153–1176 (2016)
Check Point Research: Global Cyber Attack Trends Report. Technical report (2017)
Cherepanov, A.: WIN32/INDUSTROYER: A new threat for industrial control systems. Technical report (2017)
Cisco Systems, Inc.: Midyear Cybersecurity Report. Technical report (2017)
Falliere, N., Murchu, L.O., Chien, E.: W32. stuxnet dossier. White Pap. Symantec Corp., Secur. Response 5(6), 29 (2011)
Ford, V., Siraj, A.: Applications of machine learning in cyber security. In: Proceedings of the 27th International Conference on Computer Applications in Industry and Engineering (2014)
Ghafir, I., Hammoudeh, M., Prenosil, V., Han, L., Hegarty, R., Rabie, K., Aparicio-Navarro, F.J.: Detection of advanced persistent threat using machine-learning correlation analysis. Futur. Gener. Comput. Syst. 89, 349–359 (2018)
Giura, P., Wang, W.: A context-based detection framework for advanced persistent threats. In: Proceedings of the 2012 ASE International Conference on Cyber Security, CyberSecurity 2012, SocialInformatics, pp. 69–74 (2012)
Jang-Jaccard, J., Nepal, S.: A survey of emerging threats in cybersecurity. J. Comput. Syst. Sci. 80(5), 973–993 (2014)
Kasperky Lab: The Duqu 2.0 - Technical Details (V2.1). Technical report June (2015)
Krombholz, K., Hobel, H., Huber, M., Weippl, E.: Advanced social engineering attacks. J. Inf. Secur. Appl. 22, 113–122 (2015)
Mandiant: APT1 Exposing One of China’s Cyber Espionage Units. Technical report (2013)
Mandiant: M-Trends 2017: A view from the front lines. Technical report (2017)
Navarro, J., Deruyver, A., Parrend, P.: A systematic survey on multi-step attack detection. Comput. Secur. 76, 214–249 (2018)
NIST: Managing information security risk: Organization, mission, and information system view. Special Publication 800-839 (2011)
Sharma, P.K., Moon, S.Y., Moon, D., Park, J.H.: DFA-AD: a distributed framework architecture for the detection of advanced persistent threats. Cluster Comput. 20(1), 597–609 (2017)
Shenwen, L., Yingbo, L., Xiongjie, D.: Study and research of apt detection technology based on big data processing architecture. In: 5th International Conference on Electronics Information and Emergency Communication (ICEIEC), pp. 313–316. IEEE (2015)
Shenwen, L., Yingbo, L., Xiongjie, D.: Study and research of apt detection technology based on big data processing architecture. In: 2015 5th International Conference on Electronics Information and Emergency Communication (ICEIEC), pp. 313–316. IEEE (2015)
Siddiqui, S., Khan, M.S., Ferens, K., Kinsner, W.: Detecting advanced persistent threats using fractal dimension based machine learning classification. In: Proceedings of the 2016 ACM on International Workshop on Security And Privacy Analytics - IWSPA 2016, pp. 64–69. ACM Press (2016)
Su, Y., Li, M., Tang, C., Shen, R.: A framework of apt detection based on dynamic analysis. In: 2015 4th National Conference on Electrical, Electronics and Computer Engineering. Atlantis Press (2015)
Ussath, M., Jaeger, D., Cheng, F., Meinel, C.: Advanced persistent threats: behind the scenes. In: Annual Conference on Information Science and Systems (CISS), pp. 181–186. IEEE (2016)
Xin, Y., Kong, L., Liu, Z., Chen, Y., Li, Y., Zhu, H., Gao, M., Hou, H., Wang, C.: Machine learning and deep learning methods for cybersecurity. IEEE Access 6, 35365–35381 (2018)
Acknowledgements
This research has been partially supported by Ministerio de Ciencia, Innovación y Universidades (MCIU, Spain), Agenda Estatal de Investigación (AEI, Spain), and Fondo Europeo de Desarrollo Regional (FEDER, UE) under project with reference TIN2017-84844-C2-2-R (MAGERAN) and the project with reference SA054G18 supported by Consejería de Educación (Junta de Castilla y León, Spain).
S. Quintero-Bonilla has been supported by IFARHU-SENACYT scholarship program (Panama).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Quintero-Bonilla, S., del Rey, A.M. (2020). Proposed Models for Advanced Persistent Threat Detection: A Review. In: Herrera-Viedma, E., Vale, Z., Nielsen, P., Martin Del Rey, A., Casado Vara , R. (eds) Distributed Computing and Artificial Intelligence, 16th International Conference, Special Sessions. DCAI 2019. Advances in Intelligent Systems and Computing, vol 1004. Springer, Cham. https://doi.org/10.1007/978-3-030-23946-6_16
Download citation
DOI: https://doi.org/10.1007/978-3-030-23946-6_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-23945-9
Online ISBN: 978-3-030-23946-6
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)