APT Attack Investigation via Fine-grained Sequence Construction and Learning

APT attack investigation aims to provide the security investigators a causal subgraph of the whole causal graph, so that they can easily analyze attacks. However, existing methods either output subgraphs that miss critical attack steps, or are too large and thus challenging to utilize. To address these limitations, we propose a new APT attack investigation approach based on fine-grained sequence construction and learning. Specifically, our approach is built upon the ATLAS framework, and constructs more attack sequences with a finer granularity. It then learns the attack behavior patterns from these constructed sequences. During inference, when presented with an attack symptom, our approach first predicts attack-related nodes in the causal graph and then constructs the causal subgraph based on these nodes. To evaluate our method, we conduct experiments using a simulated environment and four real attacks. The results demonstrate the effectiveness of the proposed approach compared to the state-of-the-art method ATLAS.