Multi-agent system for APT detection

Mees, Wim; Debatty, Thibault
ISSRE 2014, 25th IEEE International Symposium on Software Reliability Engineering, November 3-6, 2014, Naples, Italy

Advanced Persistent Threats (APTs) are targeted cyber attacks committed over a long period of time by highly skilled attackers. The ever increasing number of successful attacks indicates that classical network protection solutions (firewalls, Intrusion Detections Systems, proxies etc.) are no longer sufficient. Therefore, in this paper we propose a new system that combines multiples approaches using advanced aggregation techniques to achieve a better detection performance. We also test the system on real data from a small corporate network, and show that our system is able to attain a high probability of detection to probability of false alarm ratio.


DOI
HAL
Type:
Conference
City:
Naples
Date:
2014-11-03
Department:
Data Science
Eurecom Ref:
5212
Copyright:
© 2014 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
See also:

PERMALINK : https://www.eurecom.fr/publication/5212