Advanced Persistent Threat Stage Prediction

• Main Author: Pires, João Pedro Marinho
• Publication Date: 2023
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/10400.26/54491
• topic: Advanced Persistent Threat (APT); Markov model; stage of the attack; identify the potential agent; cyber defense; Ameaças Persistentes Avançadas; modelo de Markov; estágio do APT; identificar os agentes; ciberdefesa

Advanced Persistent Threat (APT) have become one of the primary challenges in cyber defense. Characterized by sophisticated and prolonged attacks, these threats infiltrate networks aiming to steal sensitive data, often remaining undetected for extended periods. This evolution in attack tactics underscores the urgent need for improvements in defense strategies and threat detection. Within the scope of this thesis, a framework named Advanced Persistent Threat Stage Prediction (APTSP) was developed. APTSP is capable of predicting, based on identified threats, the current stage of the attack, as well as the most likely subsequent stage. It also provides insights into the most probable perpetrating APT group, considering known APTs. To achieve this, APTSP takes network data classified by an Intrusion Detection System (IDS) and applies a Markov model to determine the probabilities for the APT stages. It also uses a machine learning model to identify the potential agent responsible for the attack. APTSP was experimentally evaluated on a public dataset, comparing its results with different solutions. APTSP outperformed previous approaches in all the metrics used.