English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Recently, APT attacks have frequently happened, which are increasinglycomplicated and more challenging for traditional security detection models. Thesystem logs are vital for cyber security analysis mainly due to their effectivereconstruction ability of system behavior. existing log collection tools builton ETW for Windows suffer from working shortages, including data loss, highoverhead, and weak real-time performance. Therefore, It is still very difficultto apply ETW-based Windows tools to analyze APT attack scenarios.  To address these challenges, this paper proposes an efficient and losslesskernel log collector called Kellect, which has open sourced with project atwww.kellect.org. It takes extra CPU usage with only 2%-3% and about 40MB memoryconsumption, by dynamically optimizing the number of cache and processingthreads through a multi-level cache solution. By replacing the TDH library witha sliding pointer, Kellect enhances analysis performance, achieving at least 9times the efficiency of existing tools. Furthermore, Kellect improvescompatibility with different OS versions. Additionally, Kellect enhances logsemantics understanding by maintaining event mappings and applicationcallstacks which provide more comprehensive characteristics for securitybehavior analysis.  With plenty of experiments, Kellect demonstrates its capability to achievenon-destructive, real-time and full collection of kernel log data generatedfrom events with a comprehensive efficiency of 9 times greater than existingtools. As a killer illustration to show how Kellect can work for APT, full datalogs have been collected as a dataset Kellect4APT, generated by implementingTTPs from the latest ATT&CK. To our knowledge, it is the first open benchmarkdataset representing ATT&CK technique-specific behaviors, which could be highlyexpected to improve more extensive research on APT study.

Kellect: a Kernel-Based Efficient and Lossless Event Log Collector for Windows Security