Detecting APT through graph anomaly detection - Archive ouverte HAL
Communication Dans Un Congrès Année : 2022

Detecting APT through graph anomaly detection

Résumé

Despite fruitful achievements made by unsupervised machine learning-based anomaly detection for network intrusion detection systems, they are still prone to the issue of high false alarm rates, and it is still difficult to reach very high recalls. In 2020, Leichtnam et al. proposed Sec2graph, an unsupervised approach applied to security objects graphs that exhibited interesting results on single-step attacks. The graph representation and the embedding allowed for better detection since it creates qualitative features. In this paper, we present new experiments to assess the performances of this approach for detecting APT attacks. We achieve better detection performances than the original work's baseline detection methods on the DAPT2020 dataset. This work is realised in the context of the Ph.D. thesis of Maxime Lanvin, which started in October 2021.
Fichier principal
Vignette du fichier
tmpz65x_ciq_RESSI_2022.pdf (692.33 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03675346 , version 1 (23-05-2022)

Identifiants

  • HAL Id : hal-03675346 , version 1

Citer

Maxime Lanvin, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, Ludovic Mé, et al.. Detecting APT through graph anomaly detection. RESSI 2022 - Rendez-Vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, May 2022, Chambon-sur-Lac, France. pp.1-3. ⟨hal-03675346⟩
367 Consultations
468 Téléchargements

Partager

More