Communication Dans Un Congrès Année : 2025

A Grammar-Driven Approach to Model and Detect APT Attack Sequences

Résumé

This paper introduces a grammar-driven approach to model and detect sequences of Advanced Persistent Threat (APT) attacks. APTs are characterized by their complexity and multi-step nature, making them challenging to detect with traditional systems. The proposed method employs interpretable rules to capture malicious behaviors and aligns semantically with the MITRE ATT&CK framework. This approach enables the detection of plausible attack scenarios even in the presence of incomplete or noisy data. We evaluate it using a public large CTF dataset which provides realistic and diverse attack scenarios. Experiments illustrate the effectiveness of the method in reconstructing plausible attack progressions, even with incomplete data. The main contribution of this study is an open-source implementation in Rust, ensuring reproducibility and extensibility. We also propose future enhancements to better model contextual dependencies between tactics in APT attack sequences. In a nutshell, this grammatical approach offers a robust method for detecting sophisticated threats, bridging the gap between low-level observations and high-level strategic reasoning.

Fichier principal
Vignette du fichier
multi_step_grammar-3.pdf (337.75 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-05521004 , version 1 (20-02-2026)

Licence

Identifiants

  • HAL Id : hal-05521004 , version 1

Citer

Antoine Rebstock, Yann Busnel, Romaric Ludinard. A Grammar-Driven Approach to Model and Detect APT Attack Sequences. FPS 2025: 18th International Symposium on Foundations & Practice of Security, IMT Atlantique, Nov 2025, Brest, France. ⟨hal-05521004⟩
84 Consultations
87 Téléchargements

Partager

  • More