Report 3500 Words

Question

I need a report about the Advance Persistent Threat .No plagiarism Not allow

Answer

Advanced persistent threat refers to an extremely dangerous threat that affects your enterprise or network targeted by unauthorized access for a long time with undetected while most advanced persistent threat does not cause any considerable damage to the enterprise's local machines, network, or systems it is a means to steal sensitive data making it a tool for data theft. 
 
 
Why Do These Attacks Happen? 
When you are a successful organization, it means you have valuable information regarding a business and clients an attack usually targets such organizations is sponsored by competitors' attackers, foreign government agencies, attacker use vectors such as internet, email, physical and deception, the attackers pursue their objective to steal information for an extended period. 
 
 
How does an APT attack work? 
Attackers executing APT take the following sequential approach to gain and maintain ongoing access to a target: 
APT groups can gain access by targeting systems through the internet. Normally, through phishing emails or by inserting malicious software into the target machine. After gaining access, they begin exploiting the malware they have installed to create backdoors that they can use to move around without being noticed. Once inside the targeted network, the APT group may use methods such as password cracking to gain administrative rights. They start to move laterally once threat actors have breached their target systems, including gaining administrator rights, they can then move around the enterprise network. Additionally, they start to attempt to access the other servers and other sensitive and secure areas of the network. The attackers take the data and then transfer it to their system. Remain until they are detected: The attackers can repeat this process for extended periods without being detected, they also create a backdoor by which they can recess the system in the future easily. 
How Should One Defend Against APT 
Building and maintaining an infrastructure protected by defenses such as IPS, IDS, and External and Internal security system layers. There is no single tool that can defend you against APT attacks, an effective defense requires controlling every aspect of your enterprise network through various up-to-date tools, including anti-virus, NextGen firewalls, authentication, and endpoint protection. Regular monitoring of each successful and failed login attempt by which anomalies can be spotted and identified quickly. Awareness and education for your employees because phishing emails and social engineering are more often used to trap people. Employees should be trained on what to look for and what actions should be taken if they are uncertain about an attachment and link that came by such emails or relevant medium over the internet. 
Abstract Cyber adversaries have moved from conventional cyber threats to advanced, complex, targeted, and well-coordinated attackers. These adversaries have used Advanced Persistent Threat vectors to penetrate classified and large business organizations networks by various evasive cyber techniques. This paper presents a systematic review of literature work carried out by different researchers on the topic and also explicates and compares the most significant contributions made by them in this area of APT. The paper addresses the shortfalls in the proposed techniques, forming the areas for further research. 
 
 
Keywords Advanced Persistent Threat (APT) attack · Advance Persistent Adversary (APA) · Industrial control systems (ICS) ·  
 
 
The world is faced with a very dynamic and evolving threat landscape in the cyberspace domain. Ever since computer networks have existed, cyber adversaries and cyber criminals and state-sponsored cyber offenders have tried to exploit the computer network for notorious or personal gains. They have by far succeeded in infiltrating not only the public but also the classified secure networks. Although cyber security organizations have provided state-of-the-art solutions to the existing cyber threats, hackers have succeeded in causing colossal damage to many multi billion 
 
 
dollar organizations. According to one estimate, cyber adversaries will cost business organization over $2 Trillion damage inform of data espionage and cyber frauds by 2019. Large business and military organizations have invested and are expected to invest millions of dollars in cyber security defense. According to another estimate, organizations plan to invest well over $1 Trillion on cyber security within the period 2017–2021. Despite investing considerably, incidents of cyber infiltration and security breaches continue an upward trend rather than descending. Cyber domain is an ever-changing threat landscape that has evolved constantly and finds new dimensions to target enterprise organizations for either data espionage or causes permanent damage hardware system. Among many different threats that prevail today, Advanced Persistent Threat (APT) has emerged as the most damaging threat that has ever been encountered by security specialists [1]. Contrary to spontaneous non-targeted cyberattacks by anonymous hackers, APT is a well-coordinated high profile cyber-attack that targets large commercial organizations and government entities such as military and state institutions [2]. Initially, APT was considered an unrealistic threat and unwarranted hype, however later on it proved to be a reality as more and more organizations became the victim of APT attack [3]. This led security researchers to conclude enterprise business organizations, government and military institutions are no longer immune to data breaches despite heavy investment in information security. Statistically speaking, cyber security remains a prime concern throughout the world. More than 15% of the enterprise organizations have experienced targeted attacks, out of which more than 53% ended up losing their classified sensitive data. Organizations have seen more than 200% growth in initiation of system or data recovery processes at the same time and after a week of discovering a security breach in their organizations. When it comes to cost suffered by organizations targeted, approximately $891 K average loss from single targeted attacks has been inflicted. Targeted attacks follow the same kill chain as outlined in Fig. 1. This might lead to suggest that by automatically blocking the reconnaissance phase, a multistage cyber-attack such as APT can be thwarted; however, this is not the case with APT. APT attacks have reached unprecedented levels of sophistication and nonlinearity in terms of their evolution and implementation. Therefore, a multiphase strategy such as continuous monitoring of communication, automated detection capabilities and monitoring of all types of threats is required to be implemented while thwarting APT type of attacks. The ascendance of APT has made many organizations including government agencies more alert of the type of vulnerabilities that may exist within their network and information systems. Complexity and inimitability of the attack warrants it to go beyond the perimeters of traditional network defense. This approach has allowed organizations to protect it against attackers that have already penetrated the organization network. APT has drawn considerable attention from the security community due to the ever increasing and changing threat scenario posed by it. This ever-changing threat landscape leads to lack of clear and comprehensive understanding of its inner working of APT research quandary. Before proceeding further, it is imperative that we define APT to get a clear understanding of the intensity of the cyber-attack. National Institute of Standard and Technology 
 
 
Advanced Persistent Threat (APT) Advance Persistent Adversary (APA) continues to develop unprecedented technological advancement in skills and orchestrating cyber-attacks with unparalleled dimensions. One of the threats the adversary has been able to formulate and bring into existence is called Advanced Persistent Threat (APT) which is dissimilar and lethal than any other traditional cyber threat. The threat persistently pursues its objectives repeatedly over a longer and extended period of time and adapts to any efforts by the defender in detecting it. It also maintains communication level between the host and server in order to exfiltrate its harvested data or inflict physical damage to hardware entities as and when required [7]. APT attacks are unique and complex in nature as the scope of attacks is very narrow in comparison to other common and unsophisticated attacks. APA designs a malware that aims to remain undetected over a longer duration. This aspect makes APT harder to detect and defend against [1, 6]. Generally, an APT attack is composed of six iterative phases as illustrated in Fig. 1 [5, 6] and defined as following: - • Reconnaissance Phase: The first step that cyber adversaries carry out is the phase of reconnaissance during which gathering of intelligence is carried out on the targeted organization. This involves both human and technological aspects to gather as much information about the target organization network. This is used to identify weak areas to infiltrate within the organizations network. In this phase, intelligence reconnaissance involves both technical and gathering information from weak human links. • Incursion/Penetration Phase: In this incursion phase, the APA attempts to penetrate the organization's network using many diverse techniques. It employs social engineering tactics such as spear phishing techniques and injecting malicious code using SQL injection to deliver targeted malware. It also exploits a zero-day vulnerability in the software system to find an opening into the network. • Maintaining Access Phase: Once inside the organization's network, cyber adversaries maintain access to its payload by deploying a remote administration tool (RAT). The RAT communicates with command and control (C&C;) servers outside the organization. The host and external C&C; server communication is normally encrypted HTTP communication. This allows it to easily bypass the network's firewall and defense systems by camouflaging itself to remain undetected. • Lateral Movement Phase: In this phase, the APT malware moves itself to other uninfected hosts over the network. The other host usually has higher privileged access, which provides a better chance of containing classified information and better chance of data ex-filtration. • Data Ex-filtration Phase: The last phase involved in the APT cycle is data exfiltration. The host uploads its harvested data to any external source or cloud in this phase. This process is either done in a single burst or takes place slowly without the knowledge of the end-user. Anonymous cyber-attacks are designed to target larger-scale systems to disrupt the regular operation of information systems [8]. In the case of APT, the target theater is quite diverse. Its attack signatures are more unique than any other cyberattack, making it highly target-centric. APT becomes more challenging as it sometimes involves a combination of different attack vectors embedded with some unique strategies customized for the particular target organization. It involves network penetration and data ex-filtration explicitly tailored for the target network. The horizon of the attacker in case of APT is fairly small and a well-coordinated targeted attack is aimed, mainly at government institutions and large-scale business organizations. Another characteristic of APT attack is that its attack vector is highly customized and sophisticated. It involves a blend of tools and techniques which often are executed simultaneously to launch multiple attack vectors. It either exploits zero vulnerability or by attacking the target through malware, drive-by download or uses sinkhole attacks to download APT malware [7]. Its communication is designed to conceal itself among other data packets, making it harder to detect by normal IDS and anti-virus systems [6]. Another characteristic that defines APT is its objectivity of the attack which includes business rivalry to steal trade secrets, economic motivation or military intelligence gathering. Objectively APT adversaries change over time depending upon the target organization that is being targeted. Disruption of organization networks or destruction of classified equipment in case of military organization and data pilferage are just a few examples that define APT objectivity. The APT group are highly staffed with ample technical and financial resources that may or may not operate with the support of state actors and machinery 
 
 
 Target Organizations Cyber-attacks have moved from being generalized too well-coordinated and targeted and from being simple to being sophisticated. These are by nature extensive and more serious threats than ever faced [4]. With this change in the threat landscape, cyber adversaries have now gone beyond the perimeters and moved to target-rich environments involving clandestine operations, international espionage, cyber operations, etc. These long-term, possibly state-sponsored, targeted campaigns mainly target the following types of organizations as summarized in Table 1 [5]. 
 
 
The Incursion Process of APT Attacker Cyber adversaries normally uses traditional methods of incursion into targeted organization networks. This often involves social engineering tactics using spear-phishing emails targeted toward unsuspecting employees of an organization to click on a link [5]. In addition, opening an attachment that appears to come from legitimate trusted 
 
 
a colleague of the same organization is also another common method used for incursion into the network [7]. Another method includes exploiting multiple zero-day vulnerabilities focusing on highly targeted systems and a network is also carried out to run multiple attack vectors simultaneously. This includes downloading additional tools for the purpose of network exploration and assessing various vulnerabilities [10]. As discussed earlier, the objective of cyber criminals is to remain inside the organization's network for an infinite period of time undetected. This provides them with the opportunity to fully exploit the vulnerabilities of the host network and harvest (as well as exfiltrate) as much data from the organization as it can while remaining undetected under the radar [6]. This is achieved by specifically designing APT to avoid detection at all costs, which may include evasion techniques to make the attack more difficult to detect and determine [11].Communication Mechanism Adopted by APT Attacker One of the most essential parts of APT malware is its communication with its command and control (C&C;) server from where the persistent malware takes commands and harvested data is exfiltrated [1]. The communication between the host and server is often low and slow and sometimes is camouflaged with normal network data traffic packets [9]. The communication is mostly HTTP-based, which often acts like normal network traffic. Other communication mechanisms such as peer-to-peer (P2P) and IRC are also used by cyber criminals who take advantage in terms of penetrability into the network and concealment of communication [11]. The use of HTTP protocol for communication is quite high and amounts to more than 90% of the cases of APT infiltration [12]. In addition to HTTP-based communication, other existing protocols such as FTP, SMTP, IRC, and traditional FTP-based email systems have been frequently leveraged to ex-filtrate or steal intellectual property, sensitive internal business and legal documents, and other classified data from the penetrated Advanced Persistent Threat&mdash;A Systematic Review of Literature &hellip; 167 organization [13]. The use of HTTP protocol for communication across networks by the attacker mainly provides two advantages for their accessibility. Firstly, the communication protocol is most widely used by all organizations across the globe, and secondly, it generates a huge amount of web traffic which allows them to hide their malevolent activity and bypass the organization firewall [2]. Various researchers [11, 14] have focused their detection strategy purely on detecting the communication between the APT host and its command and control (C&C;) server. This is considered to be the most essential part of APT detection as it is always essential to maintain the communication between a compromised host and the C&C; server. Most of the communication that takes place uses supervised machine learning approaches that train on the APT malware. Different malware samples have found different forms of communication methods between the compromised host and its command server. In one instance, APT sample malware communicates with its C&C; server by encoding the commands, and a response was sent in the form of cookies using base64 codes [15]. In another instance, APT malware logs the user commands by using a key-logger, downloading and executing the code, and ex-filtrating the stored data to a remote HTTP C&C; server periodically [16]. In another and most common APT case, spear phishing is used in tricking the user to download or initiate a web session [17]. Cyber criminals have also used the use of general web services such as blogs pages for infiltration purposes [18]. 3 Different Attack Vectors In addition to classified data pilferage from the target organization network, APT has another serious threat dimension that attacks the hardware system. The hardware system is normally an industrial control system or weapon system in case of a military organization. The sole purpose of this APT malware is to permanently make the system dysfunctional by causing hardware irreparable damage to its system controls. 3.1 APT&mdash;Industrial Threat Vector Advance cyber adversaries have not only attacked information systems for data pilferage but also have found ways to infiltrate and take control of industrial control systems (ICS). This is possible because of the tight coupling that exists between the cyber and physical components of industrial systems such as power grid systems, nuclear power plants, etc. This aspect of cyber-attack has far-reaching implications for human lives which are totally dependent on such systems for their normal daily activities. ICS systems such as Supervisory Control and Data Acquisitions (SCADA) systems mainly found in energy sector corporations have been the main target of cyber adversaries [19]. Despite segregation approaches applied by organizations to protect their network, cyber-attacks continue to persist. Contrary to isolated 168 S. Hussain et al.'s claims, complete network isolation remains a myth. Insider threats using microstorage devices or non-permanent modems often prove to be fatal and provide access to restricted networks [9]. This allows the malware to spread into deep isolated networks and it becomes difficult if not impossible to assess the damage and depth of infiltration into the network. 3.2 APT&mdash;Military Threat Vector APA also aims to target military installations, networks, and weapon systems. This forms the core reason why APT is termed the most dangerous in terms of lethality. It does not only target large business enterprises but its primary targets are military organizations and their weapon systems. To give an example of how terrifying this threat can become, some authorized malevolent hackers recently seized control of a weapon system acquired by the US military. The trial was conducted to assess the US's digital vulnerability of military assets [20]. Today, military assets such as radars, fighter jets, satellites, missiles, submarines, etc. and nuclear weapons delivery systems of weapons manufacturing nations have become heavily dependent on computer systems. This has allowed cyber adversaries to exploit vulnerabilities present in the core-shell of the system. The targeted attacks carried out by sophisticated adversaries have no linearity when it comes to defining the type of organization being attacked. Therefore, we state that APT can have catastrophic consequences if it remains undetected and the risk of the weapons system being used in response to a false alarm or slight miscalculation is much more real than a myth. 3.3 APT Datasets One of the most important aspects of any research is the ability to acquire useful datasets to carry out in-depth analysis. Availability of data relating to APT has been difficult to acquire as it is not publicly available and no organization is willing to share due to intellectual property laws and for the reason that this disclosure will publicly jeopardize the goodwill of the organization. Therefore, obtaining a specific dataset related to APT is quite minimal. Symantec Corporation, being a large and renowned anti-malware solution provider, has the world's largest repository of internet threats and vulnerability databases [9]. It has over 240,000 sensors in over 200 countries of the world that monitors cyber-related threats. The company also has gathered malicious code from over 133 million client servers as well as gateways in addition to deployment of honey-pot systems that collect cyberattacks across the world [9]. The organization also claims to gather data of non visible threats that possibly include APT attack data. In addition to using the datasets of Symantec Corporation, the development of the honey-pot system and its deployment on a live server is another method to gather APT datasets and generate Advanced Persistent Threat&mdash;A Systematic Review of Literature &hellip; 169 live attack scenarios during implementation. This method can also prove useful in gathering real-time datasets and eventually be used to train the model. One drawback with this approach is that it may yield just ordinary cyber-attacks and malware and no data useful related to APT. Another available option to gather APT datasets is using the available open-source dataset [21]. These datasets are highly anonymous datasets that encompass numerous months and represent several successful authentication events as well as calibration datasets from users to computers. 4 Research Techniques and Gaps Cyber security researchers have proposed limited yet significant research theories in countering APT, which are claimed to be state of the art and comprehensive approaches. However, in-depth analysis suggests that the proposed framework has limited comprehensibility and inability to adapt to diverse and ever-changing cyber threat landscape. This section has comprehensively analyzed major approaches proposed by prominent researchers on APT detection and prevention frameworks. We have also summarized the strength and weaknesses of each approach, to give a comprehensive view of the APT threat landscape. 4.1 APT Detection Framework Using Honey-Pot Systems The proposed framework implements a honey-pot system [4]. Honeypot systems are computer applications that simulate the behavior of real systems being used in an organization network. Its sole purpose is to attract cyber-attacker in attacking an isolated and monitored system. The system mimics a real live system of organization which is usually an information system. It studies the behavior of the attacker that exploits the weakness and vulnerabilities found in the information system. The cyber-attacks on the system are recorded in logs, which afterwards are analyzed in order to gain a comprehensive level of understanding into the types and sophistication of the attacks. Researchers [4] suggested that a properly configured honey-pot system be connected to an alarming system in this approach to APT detection. This would set an alarm once an APT attack is detected. This would early warn the security experts in the organization to take appropriate counter measures accordingly and thus protect the organizations vital assets. This approach offered by researchers may prove effective in detecting APT; however, it is a passive defense approach, rather than an active one. The approach is simple and straightforward with less resource consumption. This approach is only limited to its system behavior within its defined domain and cannot go beyond the prescribed domain area. The framework only focuses on incoming network traffic and disregards any check on network traffic going outside the network. This leaves a gray area of vulnerability of 170 S. Hussain et al. network traffic going outside the organization network, unsupervised and undetected under the sensor. 4.2 Detection of APT Using Intrusion Kill Chains (IKC) In this approach, the author [22] proposes to detect multi-stage cyber-attack. This approach uses the properties of Intrusion Kill Chain (IKC) to model the attack at an early stage. The model collects security event logs from various sensors such as host intrusion detection system (HIDS), firewalls and network intrusion detection systems (NIDS) for analysis and further processes it through Hadoop based log management module (HBLMM). Later on, the intelligent query system of this module correlates the event with IKC. Code and behavioral analysis is also carried out using the same module. The approaches also offer predicting IKC by analyzing collected sensor logs and mapping each of the suspicious events identified to one of the seven stages of the attack model [23]. Analysis suggests that although this approach proves to be better and efficient, it involves in-depth analysis of the network as well as host-related data flows and analysis of all system mined events. This process may be time-consuming and tedious as the amount of data collected would be phenomenal. Moreover, this approach is solely passive one and mainly focuses on solitary analysis units, i.e. system event data. Possibility of increase in false positives alarms cannot also be ruled out. 4.3 Countering Advanced Persistent Threats Through Security Intelligence and Big Data Analytics This approach [3] offers effective defense against APT and multidimensional approaches. Based upon big data analytic, the researcher intends to detect weak signals of APT intercommunication. It proposes a framework that works on two set of indicators. One is a compromised indicator, which prioritizes the hosts based on suspicious network communication The second is the exposure indicator that calculates the possibility of an APT attack. The framework that the researcher proposes is called AUSPEX (named after an interpreter of omens in ancient Rome). It proposes to include human analyst who analyzes inter-system network communications to detect APT threat within internal hosts. The final outcome of the proposed framework is a list of internal hosts arranged according to the defined compromised and exposure indicators. At the latter stage, the human analyst will analyze the internal host communication to detect APT signatures within the organization network. Critically analyzing this framework, AUSPEX is based on combining big data analytics with security intelligence of internal as well as external information. Although, this framework proposes a novel approach in detecting APT communication. However, big data Advanced Persistent Threat&mdash;A Systematic Review of Literature &hellip; 171 analytics have been used in the past to detect security violations in varied sets of data such as detecting Stuxnet, Duqa, etc. malware. In this framework, the researchers focus on assisting the security analyst in analyzing large sets of big data sets which are most likely to be compromised. This approach although offers the subset of hosts that are most likely to have been compromised. However, it is more human specialist centric, who analyzes the most likely APT infected host within the context of big data analytics. This approach, although novel, may also generate more false alarms as it does not define any rule set for analyzing compromised big data and purely relies on the skills of human specialists. Secondly, the framework also falls short of prevention of strategy of APT; rather, it focuses on confining towards detection strategies of APT using big data analytics. 4.4 APT Countermeasures Using Collaborative Security Mechanisms In this approach, the researchers [24] have presented a framework for detecting APT malware which targets the system at an early stage of infiltration into the network. This framework uses an open-source version of Security Information and Event Management (SIEM) to detect Distributed Denial of Service (DDOS) attacks. This is achieved by analyzing the system files and inter-process communication. The research revolves around the concepts of function hooking to detect zero-day malware. It uses a tool called Ambush, which is an open-source host-based intrusion prevention system (HIPS). The proposed system observes all types of function calls in the operating system (OS) and detects its behavior for any notable malevolent behavior that might lead to detection of zero-day malware. Critiquing this technique, we suggest that this approach to detect zero-day attack using OS function hooking might prove useful to security analysts in detecting APT. Furthermore, the proposed theatrical framework is primarily used in detection of DOS attack on system services and may not work for APT-based malware, as the cyber criminals are highly skilled in obfuscating the intra function calls. Moreover, this framework may yield more false-positive alarms as every function call is being monitored by the open source host based intrusion prevention system (HIPS). This method may also lead to updating the anomalies database with more false positives, thus rendering the database insignificant. The framework author suggests comprehensively automating the zero-day attack detection based on their research paper's concept. The researcher in this case does not provide any pre-infiltration phase (ability of the framework to monitor communication before penetration into the network takes place) detection in their framework. This area also needs to be included in the research in countering the APT threat at the very initial stage in order to make it a comprehensive approach. The major focus of this approach lies in detecting APT attack after its successful infiltration into the network thus falling short of comprehensibility of the approach. 172 S. Hussain et al. 4.5 APT Detection Using a Context-Based Framework In this framework, the researchers propose a conceptual model that can inference the malware based on contextual data. It proposes [25] a conceptual framework that is based on the concept of attack tree which maps itself to form an attack pyramid. The attack pyramid forms a conceptual view of the attacker's goal that takes place inside an organization network. An attack tree structure is based on the work of Amoroso [26] and Scheier [27] that have introduced the concept of correlating the attack with its lateral plain. The tree is formed by positioning the target of the attack as the root of the tree and various means of reaching the goal as the child node of the root. The attack tree depicts a visual view of vulnerable elements in hierarchical order as well as the likely path of attack. This helps the security experts to obtain an overview picture of the security architecture of the attack. The second element of the framework is notated as an attack pyramid, an extended modification of the attack tree model. It positions the attacker goal as the root of the attack pyramid which corresponds to its lateral environment to locate the position of the attack. This detection framework inferences the attack based on context and correlation rules, confidence and risk level to conclude the concentration of the threat posed. The detection rules are based on signatures, system policy, and correlation among them. It is based on a mathematical correlation function that finds relationships between independent events and its corresponding attack pyramid plain. This framework is based on matching the signature and policy with various attack events, which is a passive approach and may not lead to detecting APT type of attack. 4.6 APT Attack Detection Using Attack Intelligence The attack intelligence approach proposed by the researchers, [28] monitors and records all system events that occur in the system. Behavior and pattern matching is carried out between all recorded events with all known attack behavior and alarm is set whenever a match is found. The proposed approaches also use Deep Packet Inspection (DPI) in industrial control systems using intelligence tools like Defender and Tofino [28]. Although, the approach is based on pattern matching between behavior and event similar to formal method approach in language recognition. However, it does not offer state of the art solutions to APT traffic detection as no real-time datasets are available to update the attack behavior database. This may be a big limitation as the approach is only useful as long as the attack behavior database is up to date with the latest rules base. Advanced Persistent Threat&mdash;A Systematic Review of Literature &hellip; 173 4.7 Detection of Command and Control (C&C;) Communication in Advanced Persistent Threat Researchers [2, 11] have also proposed another novel method of detecting APT malware. This approach focuses on monitoring communication between the host and its command control (C&C;) server and leaves other detection aspects. A post-malware infiltration approach, similar to Botnet communication, the communication between C&C; servers usually takes place inform of bulk HTTP web traffic. This approach is easier for an attacker to camouflage its traffic to avoid being detected by human experts and firewalls. In this regard, various models have been proposed and tested for detection of APT traffic within web traffic with accuracy level of 99.5% of true positives as claimed. In one of the models presented [2], researchers use an unsupervised machine learning approach to detect C&C; channels in web traffic. APT follows a different set of communication patterns which is quite dissimilar to regular web traffic. The approach reconstructs the dependencies between web requests (analysis is done by plotting a web request graph) and filtering the nodes related to regular web browsing. An analyst can identify malware requests using this approach without training a malware model. The first limitations with this framework are that it is a post-infiltration approach. In contrast to other approaches proposed by the researchers, we consider this as a shortfall. Once infiltrated inside the organization network, APT malware may cause some amount of damage to the organization informed of data pilferage until and unless detected at an early stage. Secondly, once the malware successfully infiltrates the network, it would be difficult to detect without comprehensively analyzing the entire communication from external sources and inside network communication between two or more hosts. In addition, C&C; traffic can adapt itself to mimic requests similar to web browsing traffic, thus hiding itself among the bulk of HTTP packets. Another drawback with this approach is that it may increase false positive alarms due to the complexity of web request graphs. Therefore, as claimed by the researcher to have a high accuracy rate, this approach requires a supervised learning approach. An APT detection model can learn and accurately detect and correct APT communication with lesser false positives. The summarized form of APT defense techniques outlined by different researchers, including its shortfall, is stated in Table 2. In addition to the limitations identified in the frameworks proposed by various researchers, one area that has been identified by the researcher to further carry forward research is the creation of relevant training and testing datasets for APT [19]. Researchers argue that cyber-attacks constantly change and adapt to defense mechanisms placed by organizations in unsupervised anomaly based detection methods. Therefore, datasets for learning and testing the model are either not available or expensive to create. Therefore, training the model would be difficult, which would result in poor detection rate and thus chances for higher false positives and lower true negatives may increase. Summarized defense mechanisms adopted by various researchers are illustrated in Table 3. 1 
 
 
Industrial Solutions to APT Different security vendors such as Kaspersky, Symantec and others have also provided various solutions against APT type of threats. Large security organizations have presented defense mechanisms such as Network Flow Analysis, Deep Packet Analysis, Sandbox Analysis, and DNS-based intelligence [28]. Due to limited literature available on their product solution, these security mechanisms need to be tested for efficiency and cannot be commented on. Secondly, these cannot be trusted to be used in the critical organizations of the country as the threat of covert channel presence is always there. 5 Conclusion and Future Research Work Advanced Persistent Threat (APT) is a sophisticated and intelligent cyber threat authored by a highly skillful and resourceful adversary. It is viewed as the most critical peril to private and public as well as military organizations. APT is quite different from traditional cyber-attacks as its targets are selective system organizations. The APT malware tends to hide itself for a very long time and bypass normal IDS. It has a rallying mechanism of maintaining communication to its C&C; server outside the organization network and sending harvested organizational secrets outside the network.
Various research frameworks relating to the topic have been analyzed and its shortfalls have been presented in the paper. Owing to the weakness in the analyzed detection frameworks, there is a need to propose a multilayered/multiphase comprehensive APT detection and prevention framework. We suggest that the framework has capability of defense-in-depth protection in a multilayer protection and detection system protecting the enterprise organization network across different layers. We suggest that the defense strategy should ensure that any APT attack must not bypass one or more of the defense layers. We also suggest that frameworks offer a conceptual hybrid implementation strategy that uses AI-based technology such as multiagent systems or neural networks. The AI technology offers the capability to design and implement state of the art self-learning framework that adapt to multidimensional evolving cyber threats. It also offers solutions for designing efficient defense systems against APT or polymorphic malicious code. Once designed and implemented, the framework should prove to be efficient in detecting APT threats without raising false alarms. Technology such as a multiagent paradigm delivers best performance of the system and ensures a real-time mechanism in detecting and protecting against APT attacks exists. As far as the datasets related to the APT are concerned, we conclude that good quality training and testing datasets are hard to come by and they are difficult if not impossible to generate. In this regard, we suggest that the best way to generate high quality datasets is to generate our own datasets using customized hotpot systems uploaded on an isolated server. A honey-pot solution will generate much needed dataset as and when required for analysis and training the APT model. Additionally, an attack scenario can also prove helpful in deploying honey-pot systems to log a comprehensive training dataset. In order to verify the validity of this approach, the same method can also be used to gather datasets that can be applied during the implementation phase. However, on the other hand, we can also state that there is no guarantee that the dataset collected can be classified as an APT dataset. Therefore, we suggest that generating high-quality datasets related to APT that can be used to train and test detection and prevention frameworks can be considered a much-needed area for future research. Furthermore, there is also a need to carry out analysis and propose an APT defense framework for industrial control systems such as Supervisory Control and Data Acquisition (SCADA) systems and also explore different means to efficiently create training and testing data sets to train and test APT prevention framework for industrial control systems. The APT prevention framework for military control systems is also another avenue for future research, provided access to military systems is gained to carry out the research.

Category:	English
Offered Price:	$30.00
Due Date:	15 April 2022, 15:04
Added:	13 April 2022, 07:19

Price:	20.00
Added:	13 April 2022, 17:22
Words:	6156 words
Buyers:	No Buyers Yet

Report 3500 Words

Secure Payment

We let the professionals process your money

Have a similar question?