- 學位論文
進階持續性威脅之偵測與攻擊情境重建
Detection of Advanced Persistent Threat and Reconstruction of its Attack Scenario using Graph Convolutional Recurrent Networks
摘要
進階持續性威脅的攻擊者會以特定的受害者為目標，並會在受害者的使用環境中潛伏很長一段時間，因此傳統基於簽名的入侵檢測系統無法有效地保留長期的入侵指標（Indicators of Compromise，IOC）。近年來，愈來愈多論文提出方法試圖解決進階持續性威脅的問題。大多數非監督式的作法使用事先設計好的規則偵測不同的攻擊步驟並檢測攻擊發生的時間。然而，這些方法需要事先了解攻擊的模式與行為，而且規則的制定耗費時間與人力，造成偵測系統維護上的困難。因此在本論文中，我們提出了一種基於非監督式機器學習的模型，該模型會主動學習環境中的正常行為，並且偵測異常行為與重建攻擊的情境，所以此方法無需制定與更新偵測所使用的規則。另外，一般審計系統的log檔在長期紀錄中會累積大量的資料，為了實時處理大量的log檔，我們採用MORSE論文中所使用的tag propagation來減少所需分析的資料量，並且利用fast localization的技術減少機器學習的模型複雜度。從實驗結果來看，我們模型的AUC score可以達到76，其表現與基於規則的檢測系統表現相似。除此之外，我們重建的攻擊情境可以包含67%的惡意實體，並且該情境圖也可標示出大部分攻擊者所使用的入侵技術。最後本論文所採用的tag propagation可以減少80%至90%的資料分析量，不僅可以加快分析速度、提高檢測系統的AUC score也可以為後續的資安分析人員提供更加簡潔的攻擊情境圖。
並列摘要
In advanced persistent threat (APT), attackers typically target a specific victim and lurk in the victim’s computer environment for a long time. Conventional signature-based detectors thus cannot effectively capture the long-term relation- ship among various indicators of compromise. In recent years, many methods have been proposed to solve this problem. Most unsupervised methods use carefully- crafted policies to model attack steps and detect the attack occurrence. However, these methods need prior knowledge of the attack and its behavior in advance. Policy formulation and refinement are both labor-intensive and time-consuming that increases the cost to deploy the APT detector. Therefore, in this thesis we propose a method based on unsupervised machine learning to detect APT and construct its attack scenario without requiring hand-crafted policy formulation. The proposed method automatically learns from normal behavior and detects the deviation dynamically through monitoring. To process a large number of logs in real time, we adapt the well-known tag-propagation method to reduce the size of the data. We also use the message-passing framework and a fast-localization technique to feed the data into a computer with limited memory. From experiment results, the proposed method can achieve an AUC score of 76, similar to the policy-based detector. The scenario graph thus constructed captures 67% of the malicious entities with few missing techniques that attackers use to achieve their goals. The graph reduction technique employed in this thesis can also reduce the data size by 80% to 90%, thus speeding up the analysis process, improving the overall AUC score, and yielding a more concise result for security analysts.
參考文獻
延伸閱讀
- 陳嘉玫、林哲銘、歐雅惠、賴谷鑫（2015）。以汙染傳遞為基礎之行動軟體威脅行為偵測。電子商務學報，17(3)，375-392。https://doi.org/10.6188/JEB.2015.17(3).04
- 王智弘、宋孝謙、邱業宸、楊吉閔、陳彥學（2014）。兩類型入侵偵測攻擊圖與警報關連配對之研究。資訊安全通訊，20(4)，41-53。https://www.airitilibrary.com/Article/Detail?DocID=a0000270-201410-201410300016-201410300016-41-53
- 伊遠正（2020）。模組化核心層級入侵偵測與防禦系統以及使用RPS/RFS機制提升效能的研究〔碩士論文，國立暨南國際大學〕。華藝線上圖書館。https://doi.org/10.6837/ncnu202000019
- 錢又瑄（2020）。Attention-based Bidirectional Recurrent Neural Network for Recommendation System Using User Behavior and Product Information〔碩士論文，國立清華大學〕。華藝線上圖書館。https://www.airitilibrary.com/Article/Detail?DocID=U0016-0209202114072314
- 蔡旻諺（2022）。Integration of Slow-Fast Network and Attention Adaptive Graph Convolutional Network for Skeleton-Based Action Recognition〔碩士論文，國立臺灣師範大學〕。華藝線上圖書館。https://doi.org/10.6345/NTNU202200209