{"type":"ScholarlyArticle","title":"A Rule Mining-based Advanced Persistent Threats Detection System","authors":[{"name":"Sidahmed Benabderrahmane","slug":"sidahmed-benabderrahmane","given":"Sidahmed","family":"Benabderrahmane","affiliation":""},{"name":"Ghita Berrada","slug":"ghita-berrada","given":"Ghita","family":"Berrada","affiliation":""},{"name":"James Cheney","slug":"james-cheney","given":"James","family":"Cheney","affiliation":""},{"name":"Petko Valtchev","slug":"petko-valtchev","given":"Petko","family":"Valtchev","affiliation":""}],"abstract":"Advanced persistent threats (APT) are stealthy cyber-attacks that are aimed at stealing valuable information from target organizations and tend to extend in time. \r\nBlocking all APTs is impossible, security experts caution, hence the importance of research on early detection and damage limitation. \r\nWhole-system provenance-tracking and provenance trace mining are considered promising as they can help find causal relationships between activities and flag suspicious event sequences as they occur.\r\nWe introduce an unsupervised method that exploits OS-independent features reflecting process activity to detect realistic APT-like attacks from provenance traces. \r\nAnomalous processes are ranked using both frequent and rare event associations learned from traces. Results are then presented as implications which, since interpretable, help leverage causality in explaining the detected anomalies. When evaluated on Transparent Computing program datasets (DARPA), our method outperformed competing approaches.","doi":"10.24963/ijcai.2021/494","url":"https://ijcai.org/proceedings/2021/494","pdf":"https://ijcai.org/proceedings/2021/0494.pdf","markdown":"https://ijcai.org/proceedings/2021/494.md","bibtex":"https://ijcai.org/proceedings/2021/bibtex/494","volume":{"slug":"2021","title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2021","url":"https://ijcai.org/proceedings/2021/","year":2021,"location":"Montreal","dates":"19-27 August 2021","editors":"Prof. Zhi-Hua Zhou","isbn":"978-0-9992411-9-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2021"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":494,"pages":{"first":3589,"last":3596},"keywords":["Data Mining: Anomaly/Outlier Detection","Data Mining: Frequent Pattern Mining","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}