XAPT:可解释的异常驱动预测APT活动中的威胁阶段
Wei Lu1, Issa Traoré2, Isaac Woungang3
1Department of Computer Science, Keene State College, Keene, NH 03431, USA.
概括
我们开发了XAPT,这是一个分析高级持久威胁 (APT) 的可解释框架. 该方法使用异常检测和贝叶斯网络准确预测网络攻击阶段,为操作分析提供了明确的解释.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 网络安全 网络安全
背景情况:
- 先进的持久威胁 (APT) 由于其隐蔽性和多阶段性质,造成了重大风险.
- 准确的阶段级预测对于有效的APT活动分析和缓解至关重要.
研究的目的:
- 介绍XAPT,这是一个可解释的,以异常驱动的APT竞选分析框架.
- 实现对网络攻击的准确和可解释的阶段级预测.
- 为APT攻击进展提供透明,可操作的见解.
主要方法:
- 使用基于PCA的重建错误来生成校准的概率学异常分数.
- 采用贝叶斯网络分类器用于网络杀死链阶段推断,结合不确定性.
- 实施基于SHAP的特征归属,以透明地解释分类结果.
主要成果:
- 在公共数据集上,XAPT显示了高阶段级检测准确度.
- 该框架提供了可操作的特征级解读,以支持操作分析.
- 校准的异常分数和贝叶斯推理有效捕捉事件异常和依赖.
结论:
- XAPT为高级威胁检测提供了一个全面和可解释的解决方案.
- 异常评分,贝叶斯推理和SHAP解释的整合增强了APT分析.
- 该框架支持网络安全专业人员提供透明和分析友好的解释.
相关概念视频
Steps in Outbreak Investigation
485
In the ever-evolving field of public health, statistical analysis serves as a cornerstone for understanding and managing disease outbreaks. By leveraging various statistical tools, health professionals can predict potential outbreaks, analyze ongoing situations, and devise effective responses to mitigate impact. For that to happen, there are a few possible stages of the analysis:
485
Stereotype Threat and Self-fulfilling Prophecies
41.9K
When we hold a stereotype about a person, we have expectations that he or she will fulfill that stereotype. A self-fulfilling prophecy is an expectation held by a person that alters his or her behavior in a way that tends to make it true. When we hold stereotypes about a person, we tend to treat the person according to our expectations. This treatment can influence the person to act according to our stereotypic expectations, thus confirming our stereotypic beliefs. Research by Rosenthal and...
41.9K
Predicting Reaction Outcomes
10.0K
Kinetics describes the rate and path by which a reaction occurs. In contrast, thermodynamics deals with state functions and describes the properties, behavior, and components of a system. It is not concerned with the path taken by the process and cannot address the rate at which a reaction occurs. Although it does provide information about what can happen during a reaction process, it does not describe the detailed steps of what appears on an atomic or a molecular level. On the other hand,...
10.0K
Survival Tree
382
Survival trees are a non-parametric method used in survival analysis to model the relationship between a set of covariates and the time until an event of interest occurs, often referred to as the "time-to-event" or "survival time." This method is particularly useful when dealing with censored data, where the event has not occurred for some individuals by the end of the study period, or when the exact time of the event is unknown.
Building a Survival Tree
Constructing a...
Building a Survival Tree
Constructing a...
382
Theory of Attribution II: Kelley's Covariation Theory
481
Attribution theory plays a crucial role in social psychology, helping to explain how individuals interpret the causes of behavior. One prominent model within this field is Harold Kelley's covariation theory, which provides a systematic approach to determining whether internal traits or external circumstances drive a person's actions. The model posits that individuals rely on three key types of information—consensus, consistency, and distinctiveness—to make these judgments.Consensus:...
481
The Availability Heuristic
6.9K
A heuristic is a general problem-solving framework (Tversky & Kahneman, 1974). You can think of these as mental shortcuts that are used to solve problems. Different types of heuristics are used in different types of situations, and the impulse to use a heuristic occurs when one of five conditions is met (Pratkanis, 1989):
6.9K
