 |
The first paper, they adopted fuzzy clustering to correlate alerts to APT attack sequence sets. Then, they used probability transfer matrix to construct APT attack scenarios. In their experiments, they classify approximately 1000 valid alerts. And the APT attack scenarios constructed by the alerts can match the actual situation and be useful for APT attack detection. Although the experiment results seem to be good, the experiment has not been applied to a more realistic situation.
กก
The second paper, they labeled the kill chain stage by deducing from the network direction of each IDS alert. Then, they used the finite state machine method to depict the APT scenario graphs. Approximately 446,458 IDS alerts were condensed into 700 APT scenario graphs through this method. The limitation of this paper is that their algorithm can only processes network-level information.
กก
There are more researches also use kill chain for cyber attack detection, which shows that kill chain analysis is a common and reliable way to detect cyber attack. Nowadays, the rise in the number of attack techniques and corresponding detection rules will limit the detection coverage rate. Therefore, to rapidly expand the detection coverage, developing a mechanism for continuously labeling amounts of rules with TTP is urgent. |
IEEE/ICACT20220038 Slide.08
[Big Slide]
[YouTube]