Way of determining APT control channel
Ihor Yakoviv, Andrii Trokhymenko, Kyrylo Hlum · Collection Information technology and security · 2021
The widespread use of sophisticated cyber attacks against the national critical infrastructure of the APT type has been a powerful stimulus for the development of proactive cyber defense techniques. APTs are characterized by the following features: an attack is a complex set of time and space-related actions of an attacker. Separately, these actions may not arouse suspicion; the target attack action in the cyber segment of the object is prepared for a long time (from several months to a year or more); the set of actions of the attacker is a chain of tactics, the implementation of which allows to achieve the goal of the attack. Despite the variety of tools used in ARTs, the set of most tactics and their nature remain constant. The basis of many APTs is that the attacker uses unauthorized channels to control the attack via the Internet, which allows him to perform various actions in the cyberspace segment of the victim's information technology system. The task of timely identification of such channels at the stages of preparation of the target action of attack is urgent. This approach is in line with the implementation of a proactive cybersecurity strategy. Based on the results of research of information processes of formation and use of unauthorized channel, organization of processes of proactive cyber defense systems, a method of determining the control channel of APT has been developed. It can be used in the management of information and security events SIEM to determine the attack after its stage of penetration into the information technology system, but before the implementation of the stage of the target action. The method is developed on the basis of using the cybernetic model of APT using the methods of formalized analysis of information processes of modern operational cyber defense systems. As part of the research, a procedure for the formation and use of a multi-indicator template of the control channel, which is used for a comprehensive analysis of security events, was developed. To fill in the template, a software has been developed that generates information about security events on the hosts of the corporate system. Theoretical and practical results of research are focused on the use of corporate information system for proactive protection against APTs.