English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Cyber attacks are often identified using system and network logs. There havebeen significant prior works that utilize provenance graphs and ML techniquesto detect attacks, specifically advanced persistent threats, which are verydifficult to detect. Lately, there have been studies where transformer-basedlanguage models are being used to detect various types of attacks from systemlogs. However, no such attempts have been made in the case of APTs. Inaddition, existing state-of-the-art techniques that use system provenancegraphs, lack a data processing framework generalized across datasets foroptimal performance. For mitigating this limitation as well as exploring theeffectiveness of transformer-based language models, this paper proposesLogShield, a framework designed to detect APT attack patterns leveraging thepower of self-attention in transformers. We incorporate customized embeddinglayers to effectively capture the context of event sequences derived fromprovenance graphs. While acknowledging the computational overhead associatedwith training transformer networks, our framework surpasses existing LSTM andLanguage models regarding APT detection. We integrated the model parameters andtraining procedure from the RoBERTa model and conducted extensive experimentson well-known APT datasets (DARPA OpTC and DARPA TC E3). Our framework achievedsuperior F1 scores of 98% and 95% on the two datasets respectively, surpassingthe F1 scores of 96% and 94% obtained by LSTM models. Our findings suggest thatLogShield's performance benefits from larger datasets and demonstrates itspotential for generalization across diverse domains. These findings contributeto the advancement of APT attack detection methods and underscore thesignificance of transformer-based architectures in addressing securitychallenges in computer systems.

LogShield: A Transformer-based APT Detection System Leveraging Self-Attention