English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools annual

Global: Zendy Free Plan

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Advanced Persistent Threats (APT) attacks have plagued modern enterprises,causing significant financial losses. To counter these attacks, researcherspropose techniques that capture the complex and stealthy scenarios of APTattacks by using provenance graphs to model system entities and theirdependencies. Particularly, to accelerate attack detection and reduce financiallosses, online provenance-based detection systems that detect and investigateAPT attacks under the constraints of timeliness and limited resources are indire need. Unfortunately, existing online systems usually sacrifice detectiongranularity to reduce computational complexity and produce provenance graphswith more than 100,000 nodes, posing challenges for security admins tointerpret the detection results. In this paper, we design and implementNodLink, the first online detection system that maintains high detectionaccuracy without sacrificing detection granularity. Our insight is that the APTattack detection process in online provenance-based detection systems can bemodeled as a Steiner Tree Problem (STP), which has efficient onlineapproximation algorithms that recover concise attack-related provenance graphswith a theoretically bounded error. To utilize STP approximation algorithmframeworks for APT attack detection, we propose a novel design of in-memorycache, an efficient attack screening method, and a new STP approximationalgorithm that is more efficient than the conventional one in APT attackdetection while maintaining the same complexity. We evaluate NodLink in aproduction environment. The open-world experiment shows that NodLinkoutperforms two state-of-the-art (SOTA) online provenance analysis systems byachieving magnitudes higher detection and investigation accuracy while havingthe same or higher throughput.

NODLINK: An Online System for Fine-Grained APT Attack Detection and Investigation