MEGR-APT: A Memory-Efficient APT Hunting System Based on Attack Representation Learning

The stealthy and persistent nature of Advanced Persistent Threats (APTs) makes them one of the most challenging cyber threats to uncover. Several systems adopted the development of provenance-graph-based security solutions to capture this persistent nature. Provenance graphs (PGs) represent system audit logs by connecting system entities using causal relations and information flows. Hunting APTs demands the processing of ever-growing large-scale PGs of audit logs for a wide range of activities over months or years, i.e., multi-terabyte graphs. Existing APT hunting systems are typically memory-based, which suffers colossal memory consumption, or disk-based, which suffers from performance hits. Therefore, these systems are hard to scale in terms of graph size or time performance. In this paper, we propose MEGR-APT, a scalable APT hunting system to discover suspicious subgraphs matching an attack scenario (query graph) published in Cyber Threat Intelligence (CTI) reports. MEGR-APT hunts APTs in a twofold process: (i) memory-efficient extraction of suspicious subgraphs as search queries over a graph database, and (ii) fast subgraph matching based on graph neural network (GNN) and our effective attack representation learning. We compared MEGR-APT with state-of-the-art (SOTA) APT systems using popular APT benchmarks, such as DARPA TC3 and OpTC. We also tested it using a real enterprise dataset. MEGR-APT achieves an order of magnitude reduction in memory consumption while achieving comparable performance to SOTA in terms of time and accuracy.

I. Introduction

Cyber threat hunting is the process of identifying threats and ongoing attacks by proactively searching for indicators of compromise undetected in the system [1]. It aims to uncover hidden traces to limit the harm and spread of a specific attack scenario. Once a new attack is discovered, security experts identify the attack’s main characteristics and release the attack scenario in Cyber Threat Intelligence (CTI) reports. Each attack scenario shows Indicators of Compromises (IOCs) and strategies related to the attack. The threat-hunting task becomes more critical when searching for sophisticated attacks such as Advanced Persistent Threats (APTs). In some cases, APT attacks use a ‘low and slow’ approach to stay undetected for months or even years.