Identifying APT Attack Stages Using Anomaly Score Calibration
Ornella Lucresse Soh, Issa Traoré, Isaac Woungang, Wei Lu, Marcelo Luiz Brocardo · 2024
APT breaches can go undetected for long periods because of the hackers' ability to adapt to and escape defensive methods. In this paper, we present a new approach to establishing whether a security event is part of an APT attack by predicting the corresponding kill chain stage. For monitored security activity and events, the approach derives a probabilistic anomaly score using an approach based on principal component analysis (PCA) and score calibration and classifying the event with a multiclass type of Bayesian Network (BN). The proposed model was evaluated using two different public APT datasets, which yielded very encouraging performance in accurately detecting APT event occurrences and stages.