DETECTION OF ADVANCED PERSISTENT THREATS USING SIEM RULESETS

Abstract

Cyber-attacks move towards a sophisticated destructive and persistent position as in the case of Stuxnet Dark Hotel Poseidon and Carbanak. These attacks are called Advanced Persistent Threats (APTs) in which an intruder establishes an undetected presence in a network to steal sensitive data over a prolonged period. APT attacks threaten the main critical areas of today's digitalized life. This threat covers critical infrastructures finance energy and aviation agencies. One of the most significant APT attacks was Stuxnet which targeted the software controlling the programmable logic controllers (PLCs) that are in turn used to automate machine processes. The other one was the Deep Panda attack discovered in 2015 which compromised over 4 million US personnel records because of the ongoing cyberwar between China and the US. This paper explains the difficulties of detecting APTs and examines some of the research in this area. In addition we also present a new approach to detecting APTs using the Security Information and Event Management (SIEM) solution. In this approach we recommend establishing APT rulesets in SIEM solutions using the indicators left behind by the attacks. The three basic indicator types are considered in the rulesets and are examined in detail.