Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Advanced Persistent Threat Detection using Data Provenance and Metric Learning

Published

Author(s)

Khandakar Ashrafi Akbar, Yigong Wang, Gbadebo Ayoade, Yang Gao, Anoop Singhal, Latifur Khan, Bhavani Thuraisingham, kangkook Jee

Abstract

Advanced persistent threats (APT) have increased in recent times as a result of the rise in interest by nation states and sophisticated corporations to obtain high-profile information. Typically, APT attacks are more challenging to detect since they leverage zero-day attacks and common benign tools. Furthermore, these attack campaigns are often prolonged to evade detection. We leverage an approach that uses a provenance graph to obtain execution traces of host nodes in order to detect anomalous behavior. By using the provenance graph, we extract features that are then used to train an online adaptive metric learning. Online metric learning is a deep learning method that learns a function to minimize the separation between similar classes and maximizes the separation between dis-similar instances. We compare our approach with baseline models and we show our method outperforms the baseline models by increasing detection accuracy on average by 11.3% and increases True positive rate (TPR) on average by 18.3%. We also show that our method outperforms several state-of-the-art models performances in comprehensive attack datasets in both binary and multi-class settings.
Citation
IEEE Transactions on Dependable and Secure Computing
Volume
20
Issue
5

Keywords

Advanced persistent threat , data provenance , metric learning

Citation

Akbar, K. , Wang, Y. , Ayoade, G. , Gao, Y. , Singhal, A. , Khan, L. , Thuraisingham, B. and Jee, K. (2022), Advanced Persistent Threat Detection using Data Provenance and Metric Learning, IEEE Transactions on Dependable and Secure Computing, [online], https://doi.org/10.1109/TDSC.2022.3221789, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=935731 (Accessed October 15, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created November 14, 2022, Updated April 23, 2024