Multi-agent System for APT Detection

Wim Mees (1) , Thibault Debatty (2, 1)

1 Ecole Royale Militaire
2 Eurecom [Sophia Antipolis]

Advanced Persistent Threats (APTs) are targeted cyber attacks committed over a long period of time by highly skilled attackers. The ever increasing number of successful attacks indicates that classical network protection solutions (firewalls, Intrusion Detections Systems, proxies etc.) are no longer sufficient. Therefore, in this paper we propose a new system that combines multiples approaches using advanced aggregation techniques to achieve a better detection performance. We also test the system on real data from a small corporate network, and show that our system is able to attain a high probability of detection to probability of false alarm ratio.

Domaines: Cryptographie et sécurité [cs.CR]

Wim Mees, Thibault Debatty. Multi-agent System for APT Detection. 2014 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW 2014), Nov 2014, Naples, Italy. pp.401-406, ⟨10.1109/ISSREW.2014.86⟩. ⟨hal-01525732⟩