UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Abstract

Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without pre-defined attack signatures. Using a graph sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects real-life APT scenarios with high accuracy.

19 pages

References in corpus (9)

• Inductive Representation Learning on Large Graphs
• graph2vec: Learning Distributed Representations of Graphs
• NetSimile: A Scalable Approach to Size-Independent Network Similarity
• Auto-WEKA: Combined Selection and Hyperparameter Optimization of Classification Algorithms
• SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
• SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
• HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows
• FRAPpuccino: Fault-detection through Runtime Analysis of Provenance
• Benchmarking Crimes: An Emerging Threat in Systems Security

Cited by in corpus (11)

• threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning
• Combating Advanced Persistent Threats: Challenges and Solutions
• Software Updates Strategies: a Quantitative Evaluation against Advanced Persistent Threats
• A Room With an Overview: Towards Meaningful Transparency for the Consumer Internet of Things
• Contextual Agent Security: A Policy for Every Purpose
• The HitchHiker's Guide to High-Assurance System Observability Protection with Efficient Permission Switches
• HADES: Detecting Active Directory Attacks via Whole Network Provenance Analytics
• Xanthus: Push-button Orchestration of Host Provenance Data Collection
• ActMiner: Applying Causality Tracking and Increment Aligning for Graph-based Cyber Threat Hunting
• SAGA: Synthetic Audit Log Generation for APT Campaigns
• TapTree: Process-Tree Based Host Behavior Modeling and Threat Detection Framework via Sequential Pattern Mining