A Model for Detecting Complex Computer Attacks Based on the Analysis of User Actions, Network Interactions and Comparison with the MITRE ATT&CK Knowledge Base

The paper presents a model for detecting complex computer attacks based on the analysis of user actions, network interactions, and the matching of detected anomalies with the MITRE ATT&CK knowledge base. A model of a complex computer attack is described, which is a sequence of groups of events corresponding to a specific tactic from the MITRE ATT&CK knowledge base. The construction of a profile of normal user actions is described, as well as its dynamic updating. Profile generation is based on temporal, contextual and action characteristics. Profile updating is based on the definition of a threshold value that determines how significant a change must be for the profile to be updated. Anomaly detection is performed using a machine learning method 3 autoencoder and graph analysis based on a graph convolutional network (GCN). The mechanism of anomaly correlation in adaptive time domain is developed and described. Future directions for research are described.