Skip to main content
Top
Published in: The Journal of Supercomputing 8/2019

07-09-2016

A comprehensive study on APT attacks and countermeasures for future networks and communications: challenges and solutions

Authors: Saurabh Singh, Pradip Kumar Sharma, Seo Yeon Moon, Daesung Moon, Jong Hyuk Park

Published in: The Journal of Supercomputing | Issue 8/2019

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Recently in the connected digital world, targeted attack has become one of the most serious threats to conventional computing systems. Advanced persistent threat (APT) is currently one of the most important threats considering the information security concept. APT persistently collects data from a specific target by exploiting vulnerabilities using diverse attack techniques. Many researchers have contributed to find approaches and solutions to fight against network intrusion and malicious software. However, only a few of these solutions are particularly focused on APT. In this paper, we introduce a structured study on semantic-aware work to find potential contributions that analyze and detect APT in details. We propose modeling phase that discusses the typical steps in APT attacks to collect the desired information by attackers. Our research explores social network and web infrastructure exploitation as well as communication protocols and much more for future networks and communications. The paper also includes some recent Zero-day attacks, use case scenarios and cyber trends in southeastern countries. To overcome these challenges and attacks, we introduce a detailed comprehensive literature evaluation scheme that classifies and provides countermeasures of APT attack behavior. Furthermore, we discuss future research direction of APT defense framework of next-generation threat life cycle.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Literature
1.
go back to reference Chen P, Desmet L, Huygens C (2014) A study on advanced persistent threats. In: ifip International Conference on Communications and Multimedia Security, pp 63–72 Chen P, Desmet L, Huygens C (2014) A study on advanced persistent threats. In: ifip International Conference on Communications and Multimedia Security, pp 63–72
2.
go back to reference Jeun I, Lee Y, Won D (2012) A practical study on advanced persistent threats. Computer applications for security, control and system engineering. Springer, Berlin, Heidelberg, pp 144–152 Jeun I, Lee Y, Won D (2012) A practical study on advanced persistent threats. Computer applications for security, control and system engineering. Springer, Berlin, Heidelberg, pp 144–152
3.
go back to reference Moon D, Im H, Lee JD, Jong Park H (2014) MLDS: multi-layer defense system for preventing advanced persistent threats. Symmetry 6(4):997–1010CrossRef Moon D, Im H, Lee JD, Jong Park H (2014) MLDS: multi-layer defense system for preventing advanced persistent threats. Symmetry 6(4):997–1010CrossRef
4.
go back to reference Tankard C (2011) Advanced persistent threats and how to monitor and deter them. Netw Secur 8:16–19CrossRef Tankard C (2011) Advanced persistent threats and how to monitor and deter them. Netw Secur 8:16–19CrossRef
5.
go back to reference Sood AK, Enbody RJ (2013) Targeted cyberattacks: a superset of advanced persistent threats. IEEE Secur Priv 11(1):54–61 Sood AK, Enbody RJ (2013) Targeted cyberattacks: a superset of advanced persistent threats. IEEE Secur Priv 11(1):54–61
6.
go back to reference Friedberg I, Skopik F, Settanni G, Fiedler R (2015) Combating advanced persistent threats: from network event correlation to incident detection. Comput Secur 48:35–57CrossRef Friedberg I, Skopik F, Settanni G, Fiedler R (2015) Combating advanced persistent threats: from network event correlation to incident detection. Comput Secur 48:35–57CrossRef
9.
go back to reference Bilge L, Dumitras T (2012) Before we knew it: an empirical study of zero-day attacks in the real world. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security. ACM, pp 833–844 Bilge L, Dumitras T (2012) Before we knew it: an empirical study of zero-day attacks in the real world. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security. ACM, pp 833–844
10.
go back to reference Zetter K (2011) How digital detectives deciphered Stuxnet, the most menacing malware in history. Wired Mag 11:1–8 Zetter K (2011) How digital detectives deciphered Stuxnet, the most menacing malware in history. Wired Mag 11:1–8
12.
go back to reference Mustafa T (2013) Malicious data leak prevention and purposeful evasion attacks: an approach to advanced persistent threat (APT) management. In: Electronics, Communications and Photonics Conference (SIECPC), Saudi International. IEEE, pp 1–5 Mustafa T (2013) Malicious data leak prevention and purposeful evasion attacks: an approach to advanced persistent threat (APT) management. In: Electronics, Communications and Photonics Conference (SIECPC), Saudi International. IEEE, pp 1–5
14.
go back to reference Smith AM, Toppel NY (2009) Case study: using security awareness to combat the advanced persistent threat. In: 13th Colloquium for Information Systems Security Education, pp 64–70 Smith AM, Toppel NY (2009) Case study: using security awareness to combat the advanced persistent threat. In: 13th Colloquium for Information Systems Security Education, pp 64–70
16.
go back to reference Dixon CJ, Pinckney T (2013) Indicating website reputations based on website handling of personal information. US Patent no. US 2006/0253583 A1 Dixon CJ, Pinckney T (2013) Indicating website reputations based on website handling of personal information. US Patent no. US 2006/0253583 A1
17.
go back to reference Bhatti AT (2015) Integrated analysis on case study of steve gibson ddos attack may 4th, 2001: performance of testing tools and in the context of business. Int J Res Comput Appl Robot 3(7):8–12 Bhatti AT (2015) Integrated analysis on case study of steve gibson ddos attack may 4th, 2001: performance of testing tools and in the context of business. Int J Res Comput Appl Robot 3(7):8–12
18.
go back to reference Cova M, Kruegel C, Vigna G (2012) Detection and analysis of drive-by-download attacks and malicious JavaScript code. In: Proc. 19th Int’l Conf. World Wide Web, ACM Cova M, Kruegel C, Vigna G (2012) Detection and analysis of drive-by-download attacks and malicious JavaScript code. In: Proc. 19th Int’l Conf. World Wide Web, ACM
19.
go back to reference Sood AK, Enbody RJ (2011) Browser exploit packs death by bundled exploits. In: Proc. 21st Virus Bulletin Conf Sood AK, Enbody RJ (2011) Browser exploit packs death by bundled exploits. In: Proc. 21st Virus Bulletin Conf
21.
go back to reference Kim CH, Kim S, Kim JB (2016) A study of agent system model for response to spear-phishing. Int Inf Inst Tokyo Inf 19(1):263 Kim CH, Kim S, Kim JB (2016) A study of agent system model for response to spear-phishing. Int Inf Inst Tokyo Inf 19(1):263
23.
go back to reference Appelt D, Nguyen CD, Briand LC, Alshahwan N (2014) Automated testing for SQL injection vulnerabilities: an input mutation approach. In: Proceedings of the 2014 International Symposium on Software Testing and Analysis. ACM, pp 259–269 Appelt D, Nguyen CD, Briand LC, Alshahwan N (2014) Automated testing for SQL injection vulnerabilities: an input mutation approach. In: Proceedings of the 2014 International Symposium on Software Testing and Analysis. ACM, pp 259–269
26.
go back to reference Zhang YL, Xia GS (2013) The SSL MIMT attack with DNS spoofing. In: Applied Mechanics and Materials, vol. 385. Trans Tech Publications, pp 1647–1650 Zhang YL, Xia GS (2013) The SSL MIMT attack with DNS spoofing. In: Applied Mechanics and Materials, vol. 385. Trans Tech Publications, pp 1647–1650
27.
go back to reference Wang Z (2014) POSTER: on the capability of DNS cache poisoning attacks. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM, pp 1523–1525 Wang Z (2014) POSTER: on the capability of DNS cache poisoning attacks. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. ACM, pp 1523–1525
28.
go back to reference Yuan L, Chen CC, Mohapatra P, Chuah CN, Kant K (2013) A proxy view of quality of domain name service, poisoning attacks and survival strategies. ACM Trans Internet Technol (TOIT) 12(3):9CrossRef Yuan L, Chen CC, Mohapatra P, Chuah CN, Kant K (2013) A proxy view of quality of domain name service, poisoning attacks and survival strategies. ACM Trans Internet Technol (TOIT) 12(3):9CrossRef
29.
go back to reference Yamada A, Kim THJ, Perrig A (2012) Exploiting privacy policy conflicts in online social networks. Technical Report: CMU-CyLab-12-005, Carnegie Mellon University Yamada A, Kim THJ, Perrig A (2012) Exploiting privacy policy conflicts in online social networks. Technical Report: CMU-CyLab-12-005, Carnegie Mellon University
30.
go back to reference Balduzzi et al M (2012) A security analysis of Amazon’s elastic compute cloud service. In: Proc. 27th Ann. ACM Symp. Applied Computing, ACM Balduzzi et al M (2012) A security analysis of Amazon’s elastic compute cloud service. In: Proc. 27th Ann. ACM Symp. Applied Computing, ACM
31.
go back to reference Ferrie P, Szor P (2004) Cabirn fever. Virus Bulletin Magazine Ferrie P, Szor P (2004) Cabirn fever. Virus Bulletin Magazine
32.
go back to reference Stavrou A, Wang Z (2011) Exploiting smart-phone USB connectivity for fun and profit. In: BlackHat DC Conf Stavrou A, Wang Z (2011) Exploiting smart-phone USB connectivity for fun and profit. In: BlackHat DC Conf
33.
go back to reference Rutkowska J (2009) Thoughts about trusted computing. In: EuSecWest Conf Rutkowska J (2009) Thoughts about trusted computing. In: EuSecWest Conf
34.
go back to reference Wang L, Jajodia S, Singhal A, Cheng P, Noel S (2014) k-zero day safety A network security metric for measuring the risk of unknown vulnerabilities. IEEE Trans Dependable Secure Comput 11(1):30–44CrossRef Wang L, Jajodia S, Singhal A, Cheng P, Noel S (2014) k-zero day safety A network security metric for measuring the risk of unknown vulnerabilities. IEEE Trans Dependable Secure Comput 11(1):30–44CrossRef
38.
go back to reference Choi J, Choi C, Lynn HM, Kim P (2015) Ontology based APT attack behavior analysis in cloud computing. In: 2015 10th International Conference on Broadband and Wireless Computing, Communication and Applications (BWCCA), pp 375–379 Choi J, Choi C, Lynn HM, Kim P (2015) Ontology based APT attack behavior analysis in cloud computing. In: 2015 10th International Conference on Broadband and Wireless Computing, Communication and Applications (BWCCA), pp 375–379
39.
go back to reference James PF, Rohozinski R (2011) Stuxnet and the future of cyber war. Surv Glob Polit Strat 53(1):23–40 James PF, Rohozinski R (2011) Stuxnet and the future of cyber war. Surv Glob Polit Strat 53(1):23–40
40.
go back to reference Karnouskos S (2011) Stuxnet worm impact on industrial cyber-physical system security. In: 37th Annual Conference on IEEE Industrial Electronics Society, pp 4490–4494 Karnouskos S (2011) Stuxnet worm impact on industrial cyber-physical system security. In: 37th Annual Conference on IEEE Industrial Electronics Society, pp 4490–4494
41.
go back to reference Langner R (2011) Stuxnet: dissecting a cyber warfare weapon. IEEE Secur Priv 9(3):49–51CrossRef Langner R (2011) Stuxnet: dissecting a cyber warfare weapon. IEEE Secur Priv 9(3):49–51CrossRef
42.
go back to reference Falliere N, Murchu LO, Chien E (2011) W32.Stuxnet Dossier, Symantec security response, Version 1.4 Falliere N, Murchu LO, Chien E (2011) W32.Stuxnet Dossier, Symantec security response, Version 1.4
43.
go back to reference Parmar B (2012) Protecting against spear-phishing. Comput Fraud Secur 2012(1):8–11CrossRef Parmar B (2012) Protecting against spear-phishing. Comput Fraud Secur 2012(1):8–11CrossRef
44.
go back to reference Caputo DD, Pfleeger SL, Freeman JD, Johnson ME (2014) Going spear phishing: exploring embedded training and awareness. IEEE Secur Priv 12(1):28–38CrossRef Caputo DD, Pfleeger SL, Freeman JD, Johnson ME (2014) Going spear phishing: exploring embedded training and awareness. IEEE Secur Priv 12(1):28–38CrossRef
45.
go back to reference Faisal Mohammad, Ibrahim Mohammad (2012) STUXNET, DUQU and beyond. Int J Sci Eng Investig 1(2):75–78 Faisal Mohammad, Ibrahim Mohammad (2012) STUXNET, DUQU and beyond. Int J Sci Eng Investig 1(2):75–78
46.
go back to reference Bencsáth B, Pék G, Buttyán L, Félegyházi M (2012) The cousins of Stuxnet: Duqu, Flame, and Gauss. Future Internet 4(4):972–1003CrossRef Bencsáth B, Pék G, Buttyán L, Félegyházi M (2012) The cousins of Stuxnet: Duqu, Flame, and Gauss. Future Internet 4(4):972–1003CrossRef
47.
go back to reference Chen P, Desmet L, Huygens C (2014) A study on advanced persistent threats. Commun Multimed Secur 8735:63–72 Chen P, Desmet L, Huygens C (2014) A study on advanced persistent threats. Commun Multimed Secur 8735:63–72
52.
go back to reference Davis J, Clarck A (2011) Data preprocessing for anomaly based network intrusion detection: a review. Comput Secur 30:353–375CrossRef Davis J, Clarck A (2011) Data preprocessing for anomaly based network intrusion detection: a review. Comput Secur 30:353–375CrossRef
53.
go back to reference Kai HM, Liu XJ, Liu YF, Zhou L (2011) Reducing false negatives in intelligent intrusion detection decision response system. Appl Mech Mater 128:676–681CrossRef Kai HM, Liu XJ, Liu YF, Zhou L (2011) Reducing false negatives in intelligent intrusion detection decision response system. Appl Mech Mater 128:676–681CrossRef
54.
go back to reference Sommer R, Paxson V (2010) Outside the closed world: on using machine learning for network intrusion detection. In: IEEE Symposium on Security and Privacy, Oakland Sommer R, Paxson V (2010) Outside the closed world: on using machine learning for network intrusion detection. In: IEEE Symposium on Security and Privacy, Oakland
55.
go back to reference Zhou C, Leckie C, Karunasekera S (2010) A survey of coordinated attacks an collaborative intrusion detection. Comput Secur 29:124–140CrossRef Zhou C, Leckie C, Karunasekera S (2010) A survey of coordinated attacks an collaborative intrusion detection. Comput Secur 29:124–140CrossRef
61.
go back to reference Julisch K, Kruegel C (2005) Detection of intrusions and malware, and vulnerability assessment. In: Proceedings of 2nd International Conference, DIMVA Vienna, Austria, July 7–8. Springer, New York Julisch K, Kruegel C (2005) Detection of intrusions and malware, and vulnerability assessment. In: Proceedings of 2nd International Conference, DIMVA Vienna, Austria, July 7–8. Springer, New York
62.
go back to reference Abdoli F, Kahani, M (2009) Ontology-based distributed intrusion detection system. In: Computer Conference, 2009. CSICC 2009,14th International CSI. IEEE, pp 65–70 Abdoli F, Kahani, M (2009) Ontology-based distributed intrusion detection system. In: Computer Conference, 2009. CSICC 2009,14th International CSI. IEEE, pp 65–70
64.
go back to reference Chiang HS, Tsaur WJ (2009) Ontology-based mobile malware behavioral analysis. Da-Yeh University, Changhua Chiang HS, Tsaur WJ (2009) Ontology-based mobile malware behavioral analysis. Da-Yeh University, Changhua
65.
go back to reference Huang HD, Chuang TY, Tsai YL, Lee CS (2010) Ontology-based intelligent system for malware behavioral analysis. In: Fuzzy Systems (FUZZ), IEEE International Conference on, pp 1–6 Huang HD, Chuang TY, Tsai YL, Lee CS (2010) Ontology-based intelligent system for malware behavioral analysis. In: Fuzzy Systems (FUZZ), IEEE International Conference on, pp 1–6
69.
go back to reference Christodorescu M, Jha S, Seshia S, Song D, Bryant RE (2005) others: Semantics-aware malware detection. In: Security and Privacy, IEEE Symposium, pp 32–46 Christodorescu M, Jha S, Seshia S, Song D, Bryant RE (2005) others: Semantics-aware malware detection. In: Security and Privacy, IEEE Symposium, pp 32–46
70.
go back to reference Scheirer W, Chuah MC (2008) Syntax vs. semantics: competing approaches to dynamic network intrusion detection. Int J Secure Netw 3(1):24–35CrossRef Scheirer W, Chuah MC (2008) Syntax vs. semantics: competing approaches to dynamic network intrusion detection. Int J Secure Netw 3(1):24–35CrossRef
71.
go back to reference Hirono S, Yamaguchi Y, Shimada H, Takakura H (2014) Development of a secure traffic analysis system to trace malicious activities on internal networks. In: Proceeding of IEEE 38th Annual Conference on Computer Software and Applications Conference (COMPSAC). IEEE, pp 305–310 Hirono S, Yamaguchi Y, Shimada H, Takakura H (2014) Development of a secure traffic analysis system to trace malicious activities on internal networks. In: Proceeding of IEEE 38th Annual Conference on Computer Software and Applications Conference (COMPSAC). IEEE, pp 305–310
72.
go back to reference Cortes C, Vapnik V (1995) Support-vector networks. Mach Learn 20(3):273–297MATH Cortes C, Vapnik V (1995) Support-vector networks. Mach Learn 20(3):273–297MATH
73.
go back to reference Andersson S, Clark A, Mohay G, Schatz B, Zimmermann J (2005) A framework for detecting network-based code injection attacks targeting Windows and UNIX. In: Computer Security Applications Conference, 21st Annual, p 10 Andersson S, Clark A, Mohay G, Schatz B, Zimmermann J (2005) A framework for detecting network-based code injection attacks targeting Windows and UNIX. In: Computer Security Applications Conference, 21st Annual, p 10
74.
go back to reference Chien SH, Chang EH, Yu CY, Ho CS (2007) Attack sub plan based attack scenario correlation. Int Conf Mach Learn Cybern 4:1881–1887CrossRef Chien SH, Chang EH, Yu CY, Ho CS (2007) Attack sub plan based attack scenario correlation. Int Conf Mach Learn Cybern 4:1881–1887CrossRef
76.
go back to reference Zhu B, Ghorbani AA (2005) Alert correlation for extracting attack strategies. Ph.D. thesis, Citeseer Zhu B, Ghorbani AA (2005) Alert correlation for extracting attack strategies. Ph.D. thesis, Citeseer
77.
go back to reference AlEroud A, Karabatis G (2013) A system for cyber attack detection using contextual semantics. In: 7th International Conference on Knowledge Management in Organizations: Service and Cloud Computing. Springer, New York, pp 431–442 AlEroud A, Karabatis G (2013) A system for cyber attack detection using contextual semantics. In: 7th International Conference on Knowledge Management in Organizations: Service and Cloud Computing. Springer, New York, pp 431–442
78.
go back to reference He P, Karabatis G (2012) Using semantic networks to counter cyber threats. In: Intelligence and Security Informatics (ISI), IEEE International Conference on, pp 184–184 He P, Karabatis G (2012) Using semantic networks to counter cyber threats. In: Intelligence and Security Informatics (ISI), IEEE International Conference on, pp 184–184
79.
go back to reference Shannon CE (2001) A mathematical theory of communication. ACM SIGMOBILE Mob Comput Commun Rev 5(1):3–55 Shannon CE (2001) A mathematical theory of communication. ACM SIGMOBILE Mob Comput Commun Rev 5(1):3–55
80.
go back to reference Münz G, Carle G (2007) Real-time analysis of flow data for network attack detection. In: Integrated Network Management, 2007. IM’07. 10th IFIP/IEEE International Symposium on, pp 100–108 Münz G, Carle G (2007) Real-time analysis of flow data for network attack detection. In: Integrated Network Management, 2007. IM’07. 10th IFIP/IEEE International Symposium on, pp 100–108
81.
go back to reference Vance A (2014) Flow based analysis of advanced persistent threats detecting targeted attacks in cloud computing. In: Info communications Science and Technology, 2014 1st International Scientific-Practical Conference Problems of, pp 173–176 Vance A (2014) Flow based analysis of advanced persistent threats detecting targeted attacks in cloud computing. In: Info communications Science and Technology, 2014 1st International Scientific-Practical Conference Problems of, pp 173–176
82.
go back to reference Krishnamurthy B, Sen S, Zhang Y, Chen Y (2003) Sketch-based change detection: methods, evaluation, and applications. In: Proceedings of the 3rd ACM SIGCOMM Conference on Internet Measurement, pp 234–247 Krishnamurthy B, Sen S, Zhang Y, Chen Y (2003) Sketch-based change detection: methods, evaluation, and applications. In: Proceedings of the 3rd ACM SIGCOMM Conference on Internet Measurement, pp 234–247
83.
go back to reference Aleroud A, Karabatis G (2014) Context infusion in semantic link networks to detect cyber-attacks: a flow-based detection approach. IEEE, pp 175–182 Aleroud A, Karabatis G (2014) Context infusion in semantic link networks to detect cyber-attacks: a flow-based detection approach. IEEE, pp 175–182
86.
go back to reference McGuinness DL, Van HF (2004) OWL web ontology language overview. W3C Recomm 10(10):101 McGuinness DL, Van HF (2004) OWL web ontology language overview. W3C Recomm 10(10):101
87.
go back to reference Meier M (2004) A model for the semantics of attack signatures in misuse detection systems. In: Information security. Lecture notes in computer science, vol 3225. Springer, New York, pp 158–169 Meier M (2004) A model for the semantics of attack signatures in misuse detection systems. In: Information security. Lecture notes in computer science, vol 3225. Springer, New York, pp 158–169
88.
go back to reference Guarino N, Welty CA (2009) An overview of OntoClean. In: Handbook on ontologies. Springer, New York, pp 201–220 Guarino N, Welty CA (2009) An overview of OntoClean. In: Handbook on ontologies. Springer, New York, pp 201–220
89.
go back to reference Razzaq A, Ahmed HF, Hur A, Haider N (2009) Ontology based application level intrusion detection system by using Bayesian filter. In: Computer Control and Communication, 2009. IC4 2nd International Conference on, pp 1–6 Razzaq A, Ahmed HF, Hur A, Haider N (2009) Ontology based application level intrusion detection system by using Bayesian filter. In: Computer Control and Communication, 2009. IC4 2nd International Conference on, pp 1–6
90.
go back to reference Sangeetha S, Vaidehi V (2010) Fuzzy aided application layer semantic intrusion detection system—FASIDS. Int J Netw Secur Appl 2(2):39–56 Sangeetha S, Vaidehi V (2010) Fuzzy aided application layer semantic intrusion detection system—FASIDS. Int J Netw Secur Appl 2(2):39–56
93.
go back to reference Balduzzi M, Ciangaglini V, McArdle R (2013) Targeted attacks detection with spunge. In: 11th Annual International Conference on Privacy, Security and Trust (PST), 2013, pp 185–194 Balduzzi M, Ciangaglini V, McArdle R (2013) Targeted attacks detection with spunge. In: 11th Annual International Conference on Privacy, Security and Trust (PST), 2013, pp 185–194
94.
go back to reference Levenshtein VI (1966) Binary codes capable of correcting deletions, insertions, and reversals. Sov Phys Doklady 10:707–710MathSciNet Levenshtein VI (1966) Binary codes capable of correcting deletions, insertions, and reversals. Sov Phys Doklady 10:707–710MathSciNet
95.
97.
go back to reference Zarras A, Papadogiannakis A, Gawlik R, Holz T (2014) Automated generation of models for fast and precise detection of HTTP based malware. In: 12th Annual International Conference on. Privacy, Security and Trust (PST), pp 249–256 Zarras A, Papadogiannakis A, Gawlik R, Holz T (2014) Automated generation of models for fast and precise detection of HTTP based malware. In: 12th Annual International Conference on. Privacy, Security and Trust (PST), pp 249–256
98.
go back to reference Gamer T, Scholler M, Bless R (2006) A granularity-adaptive system for in-network attack detection. In: Proceedings of the IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation, pp 47–50 Gamer T, Scholler M, Bless R (2006) A granularity-adaptive system for in-network attack detection. In: Proceedings of the IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation, pp 47–50
99.
go back to reference Luo X, Chan EW, Chang RK (2006) Vanguard: a new detection scheme for a class of TCP-targeted denial-of-service attacks. In: Network Operations and Management Symposium, NOMS, 10th IEEE/IFIP, pp 507–518 Luo X, Chan EW, Chang RK (2006) Vanguard: a new detection scheme for a class of TCP-targeted denial-of-service attacks. In: Network Operations and Management Symposium, NOMS, 10th IEEE/IFIP, pp 507–518
100.
go back to reference Ansarinia M, Asghari SA, Souzani A, Ghaznavi A (2012) Ontology-based modeling of DDoS attacks for attack plan detection. In: 2012 6th International Symposium on Telecommunications (IST), pp 993–998 Ansarinia M, Asghari SA, Souzani A, Ghaznavi A (2012) Ontology-based modeling of DDoS attacks for attack plan detection. In: 2012 6th International Symposium on Telecommunications (IST), pp 993–998
104.
105.
go back to reference Sikorski M, Honig A (2012) Practical malware analysis: the hands-on guide to dissecting malicious software. No Starch, San Francisco Sikorski M, Honig A (2012) Practical malware analysis: the hands-on guide to dissecting malicious software. No Starch, San Francisco
106.
go back to reference Egele M, Scholte T, Kirda E, Kruegel C (2012) A survey on automated dynamic malware-analysis techniques and tools. ACM Comput Surv (CSUR) 44(2):6CrossRef Egele M, Scholte T, Kirda E, Kruegel C (2012) A survey on automated dynamic malware-analysis techniques and tools. ACM Comput Surv (CSUR) 44(2):6CrossRef
107.
go back to reference Idika N, Mathur AP (2007) A survey of malware detection techniques. Technical report 286, Department of Computer Science, Purdue University, USA Idika N, Mathur AP (2007) A survey of malware detection techniques. Technical report 286, Department of Computer Science, Purdue University, USA
108.
go back to reference Wagner M, Fischer F, Luh R, Haberson A, Rind A, Keim D, Aigner W, Borgo R, Ganovelli F, Viola I (2015) A Survey of Visualization Systems for Malware Analysis. In: EG Conference on Visualization (EuroVis)-STARs, pp 105–125 Wagner M, Fischer F, Luh R, Haberson A, Rind A, Keim D, Aigner W, Borgo R, Ganovelli F, Viola I (2015) A Survey of Visualization Systems for Malware Analysis. In: EG Conference on Visualization (EuroVis)-STARs, pp 105–125
109.
go back to reference Dornhackl H, Kadletz K, Luh R, Tavolato P (2014) Malicious behavior patterns. In: IEEE 8th International Symposium on Service Oriented System Engineering (SOSE), pp 384–389 Dornhackl H, Kadletz K, Luh R, Tavolato P (2014) Malicious behavior patterns. In: IEEE 8th International Symposium on Service Oriented System Engineering (SOSE), pp 384–389
110.
go back to reference Kumar S, Spafford EH (1994) A pattern matching model for misuse intrusion detection. In: Proceedings of the 17\(^{{\rm th}}\) National computer Security Conference, pp 11–21 Kumar S, Spafford EH (1994) A pattern matching model for misuse intrusion detection. In: Proceedings of the 17\(^{{\rm th}}\) National computer Security Conference, pp 11–21
111.
go back to reference Peyman K, Ali AG (2005) Research on intrusion detection and response: a survey. IJ Netw Secur 1(2):84–102 Peyman K, Ali AG (2005) Research on intrusion detection and response: a survey. IJ Netw Secur 1(2):84–102
112.
go back to reference Wagner D, Soto P (2002) Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, pp 255–264 Wagner D, Soto P (2002) Mimicry attacks on host-based intrusion detection systems. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, pp 255–264
113.
go back to reference Landwehr CE, Bull AR, McDermott JP, Choi WS (1994) A taxonomy of computer program security flaws. ACM Comput Surv (CSUR) 26(3):211–254CrossRef Landwehr CE, Bull AR, McDermott JP, Choi WS (1994) A taxonomy of computer program security flaws. ACM Comput Surv (CSUR) 26(3):211–254CrossRef
114.
go back to reference Raskin V, Hempelmann CF, Triezenberg KE, Nirenburg S (2001) Ontology in information security: a useful theoretical foundation and methodological tool. In: Proceedings of the Workshop on New Security Paradigms, pp 53–59 Raskin V, Hempelmann CF, Triezenberg KE, Nirenburg S (2001) Ontology in information security: a useful theoretical foundation and methodological tool. In: Proceedings of the Workshop on New Security Paradigms, pp 53–59
115.
go back to reference FernándezL M, Gómez-Pérez A, Juristo N (1997) Methontology: from ontological art towards ontological engineering. In: AAAI Symposium on Ontological Engineering, American Association for Artificial Intelligence FernándezL M, Gómez-Pérez A, Juristo N (1997) Methontology: from ontological art towards ontological engineering. In: AAAI Symposium on Ontological Engineering, American Association for Artificial Intelligence
116.
go back to reference Anagnostopoulos T, Anagnostopoulos C, Hadjiefthymiades S (2005) Enabling attack behavior prediction in ubiquitous environments. In: Pervasive Services, 2005. ICPS’05, Proceedings of International Conference on, pp 425–428 Anagnostopoulos T, Anagnostopoulos C, Hadjiefthymiades S (2005) Enabling attack behavior prediction in ubiquitous environments. In: Pervasive Services, 2005. ICPS’05, Proceedings of International Conference on, pp 425–428
117.
go back to reference Yan W, Hou E, Ansari N (2004) Extracting attack knowledge using principal-subordinate consequence tagging case grammar and alerts semantic networks. In: Local Computer Networks, 29th Annual IEEE International Conference on, pp 110–100 Yan W, Hou E, Ansari N (2004) Extracting attack knowledge using principal-subordinate consequence tagging case grammar and alerts semantic networks. In: Local Computer Networks, 29th Annual IEEE International Conference on, pp 110–100
119.
go back to reference Zimmer D, Unland R (1999) On the semantics of complex events in active database management systems. In: 1999, Proceedings of 15th International Conference on, Data Engineering, pp 392–399 Zimmer D, Unland R (1999) On the semantics of complex events in active database management systems. In: 1999, Proceedings of 15th International Conference on, Data Engineering, pp 392–399
121.
go back to reference Totel E, Vivinis B, Mé L (2004) A language driven intrusion detection system for event and alert correlation. In: Proceedings at the 19th IFIP International Information Security Conference. Kluwer Academic, Toulouse, Springer, New York, pp 209–224 Totel E, Vivinis B, Mé L (2004) A language driven intrusion detection system for event and alert correlation. In: Proceedings at the 19th IFIP International Information Security Conference. Kluwer Academic, Toulouse, Springer, New York, pp 209–224
123.
go back to reference Gorodetski V, Kotenko I, Karsaev O (2003) Multi-agent technologies for computer network security: attack simulation, intrusion detection and intrusion detection learning. Comput Syst Sci Eng 18(4):191–200 Gorodetski V, Kotenko I, Karsaev O (2003) Multi-agent technologies for computer network security: attack simulation, intrusion detection and intrusion detection learning. Comput Syst Sci Eng 18(4):191–200
124.
go back to reference Bhatt P, Yano ET, Gustavsson P (2014) Towards a framework to detect multi-stage advanced persistent threat sattacks. Proceeding of IEEE 8th international symposium on service oriented system engineering (SOSE). IEEE, pp 390–395 Bhatt P, Yano ET, Gustavsson P (2014) Towards a framework to detect multi-stage advanced persistent threat sattacks. Proceeding of IEEE 8th international symposium on service oriented system engineering (SOSE). IEEE, pp 390–395
125.
go back to reference Hutchins EM, Cloppert MJ, Amin RM (2011) Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Lead Issues Inf Warfare Secur Res 1:80 Hutchins EM, Cloppert MJ, Amin RM (2011) Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Lead Issues Inf Warfare Secur Res 1:80
126.
go back to reference Mathew S, Upadhyaya S, Sudit M, Stotz A (2010) Situation awareness of multistage cyber attacks by semantic event fusion. In: Military Communications Conference, 2010-MILCOM 2010. IEEE, pp 1286–1291 Mathew S, Upadhyaya S, Sudit M, Stotz A (2010) Situation awareness of multistage cyber attacks by semantic event fusion. In: Military Communications Conference, 2010-MILCOM 2010. IEEE, pp 1286–1291
127.
go back to reference Stotz A, Sudit M (2007) Information fusion engine for real-time decision-making (INFERD): a perceptual system for cyber attack tracking. In: Information Fusion, 2007 10th International Conference on, pp 1–8 Stotz A, Sudit M (2007) Information fusion engine for real-time decision-making (INFERD): a perceptual system for cyber attack tracking. In: Information Fusion, 2007 10th International Conference on, pp 1–8
128.
go back to reference Mathew S, Giomundo R, Upadhyaya S, Sudit M, Stotz A (2006) Understanding multistage attacks by attack-track based visualization of heterogeneous event streams. In: Proceedings of the 3rd International Workshop on Visualization for Computer Security, pp 1–6 Mathew S, Giomundo R, Upadhyaya S, Sudit M, Stotz A (2006) Understanding multistage attacks by attack-track based visualization of heterogeneous event streams. In: Proceedings of the 3rd International Workshop on Visualization for Computer Security, pp 1–6
130.
go back to reference Atighetchi M, Griffith J, Emmons I, Mankins D, Guidorizzi R (2014) Federated access to cyber observables for detection of targeted attacks. In: Proceeding of IEEE on Military Communications Conference (MILCOM), IEEE. pp 60–66 Atighetchi M, Griffith J, Emmons I, Mankins D, Guidorizzi R (2014) Federated access to cyber observables for detection of targeted attacks. In: Proceeding of IEEE on Military Communications Conference (MILCOM), IEEE. pp 60–66
131.
go back to reference Sadighian A, Zargar ST, Fernandez JM, Lemay A (2013) Semantic-based context-aware alert fusion for distributed Intrusion Detection Systems. In International Conference on, Risks and Security of Internet and Systems (CRiSIS), pp 1–6 Sadighian A, Zargar ST, Fernandez JM, Lemay A (2013) Semantic-based context-aware alert fusion for distributed Intrusion Detection Systems. In International Conference on, Risks and Security of Internet and Systems (CRiSIS), pp 1–6
132.
go back to reference Gabriel R, Hoppe T, Pastwa A, Sowa S (2009) Analyzing malware log data to support security information and event management: some research results. In: Proceeding of IEEE First International Conference on Advances in Databases, Knowledge, and Data Applications (DBKDA). IEEE, pp 108–113 Gabriel R, Hoppe T, Pastwa A, Sowa S (2009) Analyzing malware log data to support security information and event management: some research results. In: Proceeding of IEEE First International Conference on Advances in Databases, Knowledge, and Data Applications (DBKDA). IEEE, pp 108–113
133.
go back to reference Langeder S (2014) Towards dynamic attack recognition for SIEM. Ph.D. thesis, St. Poelten University of Applied Sciences Langeder S (2014) Towards dynamic attack recognition for SIEM. Ph.D. thesis, St. Poelten University of Applied Sciences
134.
go back to reference Strasburg C, Basu S, Wong JS (2013) S-MAIDS: a semantic model for automated tuning, correlation, and response selection in intrusion detection systems, In: Proceeding of IEEE 37th Annual Conference on Computer Softwareand Applications Conference (COMPSAC). IEEE, pp 319–328 Strasburg C, Basu S, Wong JS (2013) S-MAIDS: a semantic model for automated tuning, correlation, and response selection in intrusion detection systems, In: Proceeding of IEEE 37th Annual Conference on Computer Softwareand Applications Conference (COMPSAC). IEEE, pp 319–328
Metadata
Title
A comprehensive study on APT attacks and countermeasures for future networks and communications: challenges and solutions
Authors
Saurabh Singh
Pradip Kumar Sharma
Seo Yeon Moon
Daesung Moon
Jong Hyuk Park
Publication date
07-09-2016
Publisher
Springer US
Published in
The Journal of Supercomputing / Issue 8/2019
Print ISSN: 0920-8542
Electronic ISSN: 1573-0484
DOI
https://doi.org/10.1007/s11227-016-1850-4

Other articles of this Issue 8/2019

The Journal of Supercomputing 8/2019 Go to the issue

Premium Partner