On Preempting Advanced Persistent Threats Using Probabilistic Graphical Models

Abstract

This paper presents PULSAR, a framework for pre-empting Advanced Persistent Threats (APTs). PULSAR employs a probabilistic graphical model (specifically a Factor Graph) to infer the time evolution of an attack based on observed security events at runtime. PULSAR (i) learns the statistical significance of patterns of events from past attacks; (ii) composes these patterns into FGs to capture the progression of the attack; and (iii) decides on preemptive actions. PULSAR's accuracy and its performance are evaluated in three experiments at SystemX: (i) a study with a dataset containing 120 successful APTs over the past 10 years (PULSAR accurately identifies 91.7%); (ii) replaying of a set of ten unseen APTs (PULSAR stops 8 out of 10 replayed attacks before system integrity violation, and all ten before data exfiltration); and (iii) a production deployment of PULSAR (during a month-long deployment, PULSAR took an average of one second to make a decision).

References in corpus (6)

• Snorkel: Rapid Training Data Creation with Weak Supervision
• Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web
• OpenGM: A C++ Library for Discrete Graphical Models
• Catching Worms, Trojan Horses and PUPs: Unsupervised Detection of Silent Delivery Campaigns
• Vulnerable Open Source Dependencies: Counting Those That Matter
• Attack Analysis Results for Adversarial Engagement 1 of the DARPA Transparent Computing Program