Communication Dans Un Congrès Année : 2025

GReAT-BeD: Graph Rewriting for Activity Tracking and (Malicious) Behaviour Detection

Résumé

Living-off-the-Land is a cyberattack technique where cybercriminals exploit legitimate pre-installed tools within the victims’ system. These attacks are particularly challenging to detect due to their subtle and legitimate appearance, allowing threat actors to "hide in plain sight." This paper introduces a novel framework for identifying potentially malicious high-level behaviours using graph rewriting techniques. Our approach employs a three-layered methodology: the low-level layer captures system events and command-line data, the system behavior graph layer aggregates this data into meaningful behaviors, and the Indicators of Attack graph layer identifies high-level attack patterns through graph rewriting rules. We developed a general approach to generate a system behaviour graph from lower-layer as well as 27 rewriting rules to automatically transform this graph into Indicators of Attack representations, capturing complex behaviours and information flows. We implemented the transformation rules in the Attributed Graph Grammar System program and applied them to two use cases to demonstrate the effectiveness of our method in identifying potentially malicious behaviours across various attack scenarios.

Fichier non déposé

Dates et versions

hal-05250781 , version 1 (11-09-2025)

Identifiants

  • HAL Id : hal-05250781 , version 1

Citer

Antonin Verdier, Romain Laborde, Abdelmalek Benzekri. GReAT-BeD: Graph Rewriting for Activity Tracking and (Malicious) Behaviour Detection. 29th International Conference on Knowledge-Based and Intelligent Information & Engineering Systems (KES 2025), Sep 2025, Osaka, Japan. ⟨hal-05250781⟩
167 Consultations
0 Téléchargements

Partager

  • More