Detecting APT through graph anomaly detection

Maxime Lanvin (1, 2) , Pierre-François Gimenez (1, 2) , Yufei Han (2, 3) , Frédéric Majorczyk (4, 2) , Ludovic Mé (2, 3) , Éric Totel (5, 6, 7, 2)

1 CentraleSupélec [campus de Rennes]
2 CIDRE - Confidentialité, Intégrité, Disponibilité et Répartition
3 Inria Rennes – Bretagne Atlantique
4 DGA.MI - DGA Maîtrise de l'information
5 IP Paris - Institut Polytechnique de Paris
6 TSP - RST - Département Réseaux et Services de Télécommunications
7 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité

Despite fruitful achievements made by unsupervised machine learning-based anomaly detection for network intrusion detection systems, they are still prone to the issue of high false alarm rates, and it is still difficult to reach very high recalls. In 2020, Leichtnam et al. proposed Sec2graph, an unsupervised approach applied to security objects graphs that exhibited interesting results on single-step attacks. The graph representation and the embedding allowed for better detection since it creates qualitative features. In this paper, we present new experiments to assess the performances of this approach for detecting APT attacks. We achieve better detection performances than the original work's baseline detection methods on the DAPT2020 dataset. This work is realised in the context of the Ph.D. thesis of Maxime Lanvin, which started in October 2021.

Mots clés: Intrusion detection; Graph analysis; Machine learning; Anomaly detection

Domaines: Cryptographie et sécurité [cs.CR]

Maxime Lanvin, Pierre-François Gimenez, Yufei Han, Frédéric Majorczyk, Ludovic Mé, et al.. Detecting APT through graph anomaly detection. RESSI 2022 - Rendez-Vous de la Recherche et de l'Enseignement de la Sécurité des Systèmes d'Information, May 2022, Chambon-sur-Lac, France. pp.1-3. ⟨hal-03675346⟩