TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning
<|reference_start|>TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning: APT (Advanced Persistent Threat) with the characteristics of persistence, stealth, and diversity is one of the greatest threats against cyber-infrastructure. As a countermeasure, existing studies leverage provenance graphs to capture the complex relations between system entities in a host for effective APT detection. In addition to detecting single attack events as most existing work does, understanding the tactics / techniques (e.g., Kill-Chain, ATT&CK) applied to organize and accomplish the APT attack campaign is more important for security operations. Existing studies try to manually design a set of rules to map low-level system events to high-level APT tactics / techniques. However, the rule based methods are coarse-grained and lack generalization ability, thus they can only recognize APT tactics and cannot identify fine-grained APT techniques and mutant APT attacks. In this paper, we propose TREC, the first attempt to recognize APT tactics / techniques from provenance graphs by exploiting deep learning techniques. To address the "needle in a haystack" problem, TREC segments small and compact subgraphs covering individual APT technique instances from a large provenance graph based on a malicious node detection model and a subgraph sampling algorithm. To address the "training sample scarcity" problem, TREC trains the APT tactic / technique recognition model in a few-shot learning manner by adopting a Siamese neural network. We evaluate TREC based on a customized dataset collected and made public by our team. The experiment results show that TREC significantly outperforms state-of-the-art systems in APT tactic recognition and TREC can also effectively identify APT techniques.<|reference_end|>
@article{lv2024trec:,
    title={TREC: APT Tactic / Technique Recognition via Few-Shot Provenance
  Subgraph Learning},
    author={Mingqi Lv, HongZhe Gao, Xuebo Qiu, Tieming Chen, Tiantian Zhu, Jinyin
  Chen and Shouling Ji},
    journal={arXiv preprint arXiv:2402.15147},
    year={2024},
    doi={10.1145/3658644.3690221},
    archivePrefix={arXiv},
    eprint={2402.15147},
    primaryClass={cs.CR cs.LG}
}