276 citations · 413 across the 7 of their papers we have counts for
3 papers · 1 filter
ProPatrol: Attack Investigation via Extracted High-Level Tasks
Sadegh M. Milajerdi, Birhanu Eshete, Rigel Gjomemo +1
Kernel audit logs are an invaluable source of information in the forensic investigation of a cyber-attack. However, the coarse granularity of dependency information in audit logs l…
HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows
Sadegh M. Milajerdi, Rigel Gjomemo, Birhanu Eshete +2
In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of…
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
Md Nahid Hossain, Sadegh M Milajerdi, Junao Wang +5
We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a p…