A context-based detection framework for advanced persistent threats

Proceedings of the 2012 ASE International Conference on Cyber Security, CyberSecurity 2012

Volumn , Issue , 2012, Pages 69-74

  Giura, Paul ^a   Wang, Wei ^a  

^a ATandT Security Research Center   (United States)

Author keywords

APT; Security

Indexed keywords

CONTEXT-BASED; CYBER THREATS; DETECTION FRAMEWORK; DETECTION PROBLEMS; ORGANIZATION NETWORKS; SECURITY;

COMPUTER WORMS;

EID: 84881032625     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CyberSecurity.2012.16     Document Type: Conference Paper

References (11)

1. RSA, "RSA Security Brief: Mobilizing Intelligent Security Operations for Advanced Persistent Threats," http://www.rsa.com/innovation/docs/ 11313 APT BRF 0211.pdf, February 2011.
2. B. Krekel, G. Bakos, and C. Barnett, "Capability of the People's Republic of China to conduct cyber warfare and computer network exploitation," The US-China Economic and Security Review Commission, Washington, DC, Research Report, 2009.
3. SANS Technology Institute, "Assessing Outbound Traffic to Uncover Advanced Persistent Threat," http://www.sans.edu/student-files/projects/ JWP-Binde-McRee-OConnor.pdf, May 2011.
4. Verizon, "2010 Data Breach Investigations Report," http://newscenter.verizon.com/press-releases/verizon/2010/2010-data-breach- report-from.html, July 2010.
5. Damballa, "The Command Structure of the Aurora Botnet," http://www.damballa.com/research/aurora/, March 2010.
6. E. G. Amoroso, Fundamentals of computer security technology. Upper Saddle River, NJ, USA: Prentice-Hall, Inc., 1994.
7. B. Schneier, "Attack Trees - Modeling Security Threats," Dr. Dobb's Journal, December 1999.
8. L. Brenna, A. Demers, J. Gehrke, M. Hong, J. Ossher, B. Panda, M. Riedewald, M. Thatte, and W. White, "Cayuga: a high-performance event processing engine," in Proceedings of the 2007 ACM International Conference on Management of Data, ser. SIGMOD '07, 2007.
9. IBM, "A Conceptual Model for Event Processing Systems," http://www.ibm.com/developerworks/webservices/library/ws-eventprocessing/index. html, February 2010.
10. S. A. Camtepe and B. Yener, "Modeling and Detection of Complex Attacks," in 3rd International Conference on Security and Privacy in Communication Networks, September 2007.
11. M. Balazinska, Y. Kwon, N. Kuchta, and D. Lee, "Moirae: History- Enhanced Monitoring," in CIDR, 2007.