English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Advanced persistent threats (APTs) are organized prolonged cyberattacks bysophisticated attackers. Although APT activities are stealthy, they interactwith the system components and these interactions lead to information flows.Dynamic Information Flow Tracking (DIFT) has been proposed as one of theeffective ways to detect APTs using the information flows. However, wide rangesecurity analysis using DIFT results in a significant increase in performanceoverhead and high rates of false-positives and false-negatives generated byDIFT. In this paper, we model the strategic interaction between APT and DIFT asa non-cooperative stochastic game. The game unfolds on a state spaceconstructed from an information flow graph (IFG) that is extracted from thesystem log. The objective of the APT in the game is to choose transitions inthe IFG to find an optimal path in the IFG from an entry point of the attack toan attack target. On the other hand, the objective of DIFT is to dynamicallyselect nodes in the IFG to perform security analysis for detecting APT. Ourgame model has imperfect information as the players do not have informationabout the actions of the opponent. We consider two scenarios of the game (i)when the false-positive and false-negative rates are known to both players and(ii) when the false-positive and false-negative rates are unknown to bothplayers. Case (i) translates to a game model with complete information and wepropose a value iteration-based algorithm and prove the convergence. Case (ii)translates to a game with unknown transition probabilities. In this case, wepropose Hierarchical Supervised Learning (HSL) algorithm that integrates aneural network, to predict the value vector of the game, with a policyiteration algorithm to compute an approximate equilibrium. We implemented ouralgorithms on real attack datasets and validated the performance of ourapproach.

Stochastic Dynamic Information Flow Tracking Game using Supervised Learning for Detecting Advanced Persistent Threats