Authors:
Robert Luh
1
;
Sebastian Schrittwieser
2
;
Stefan Marschalek
2
and
Helge Janicke
3
Affiliations:
1
St. Pölten University of Applied Sciences and De Montfort University, Austria
;
2
St. Pölten University of Applied Sciences, Austria
;
3
De Montfort University, United Kingdom
Keyword(s):
Intrusion Detection, Malware, Anomaly, Behavioral Analysis, Knowledge Generation, Graph.
Related
Ontology
Subjects/Areas/Topics:
Internet Technology
;
Intrusion Detection and Response
;
Web Information Systems and Technologies
Abstract:
Current signature-based malware detection systems are heavily reliant on fixed patterns that struggle with
unknown or evasive applications, while behavior-based solutions usually leave most of the interpretative work
to a human analyst. In this paper, we propose a system able to explain anomalous behavior within a user session
by considering anomalies identified through their deviation from a set of baseline process graphs. To minimize
computational requirements we adapt star structures, a bipartite representation used to approximate the edit
distance between two graphs. Baseline templates are generated automatically and adapt to the nature of the
respective process. We prototypically implement smart anomaly explication through a number of competency
questions derived and evaluated using the decision tree algorithm. The determined key factors are ultimately
mapped to a dedicated APT attack stage ontology that considers actions, actors, as well as target assets.