{"id":1699,"date":"2022-04-06T12:03:38","date_gmt":"2022-04-06T12:03:38","guid":{"rendered":"https:\/\/sappan-project.eu\/?p=1699"},"modified":"2022-04-07T23:37:22","modified_gmt":"2022-04-07T23:37:22","slug":"for-security-analysts-a-picture-may-be-worth-more-than-a-thousand-words","status":"publish","type":"post","link":"https:\/\/sappan-project.eu\/?p=1699","title":{"rendered":"For security analysts, a picture may be worth more than a thousand words"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Dmitriy Komashinskiy and Andrew Patel (WithSecure)<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
In SAPPAN, we have developed several models for detecting anomalous events in endpoints. For example, we have built a model for identifying anomalous process launch events and a model for identifying anomalous \u201cmodule load\u201d operations. In order to increase the reliability of detections reported by the models and to support security analysts in handling those detections, we have experimented with combining detected anomalies in so-called provenance graphs. Our hypothesis here is that cyberattacks often result in multiple anomalies involving the same endpoint entities. This blog post presents our initial approach.<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t


Introduction<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<\/p>

When developing cyber-attack\ndetection and response mechanisms, finding appropriate trade-offs between often\ncontradictory precision and sensitivity requirements is a serious challenge for\ntwo main reasons: (1) exaggerated sensitivity demands lead to an information\noverload which can cause security analysts to miss attacker activities due to\noverwhelming noise created by false positives, and (2) exaggerated precision demands,\non the other hand, cause the incoming stream of potentially relevant signals to\nbe narrowed down and result in attacker operation detections going unnoticed\nuntil it is too late. One way to solve this problem is to develop auxiliary\napproaches and tools that illustrate how a computer system flagged as \u201cpotentially\nunder attack\u201d came to be in that state. <\/span><\/p>\n\n

Traditionally, approaches for\ndetecting malware and cyber-attacks are divided into two groups: misuse\ndetection and anomaly detection. Well known examples from the former group rely\non descriptions of static and dynamic patterns of attacks that are encapsulated\nin detection rules written by experts. The latter encompasses various\napproaches to determining uncommon states and behaviours that include heuristics,\nstatistical methods, machine learning techniques, and so forth.<\/span><\/p>\n\n

In SAPPAN, we have developed a set of\nmodels designed to detect specific classes of anomalous endpoint behaviour and\na method for presenting connections among detected anomalies as a node-edge graph.\nIn this article, we illustrate how our proposed methodology \u2013 a combination of elements\nof state provenance and statistical anomaly detection \u2013 can be used to help\nanalysts, threat hunters and incident investigators in their day-to-day\nactivities. <\/span><\/p>\n\n\n\n\n\n