Cyber Kill Chain-Based Taxonomy of Advanced Persistent Threat Actors: Analogy of Tactics, Techniques, and Procedures
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
The need for cyber resilience is increasingly important in our technology-dependent society where computingdevices and data have been, and will continue to be, the target of cyber-attackers, particularly advancedpersistent threat (APT) and nation-state/sponsored actors. APT and nation-state/sponsored actors tend to bemore sophisticated, having access to significantly more resources and time to facilitate their attacks, which inmost cases are not financially driven (unlike typical cyber-criminals). For example, such threat actors oftenutilize a broad range of attack vectors, cyber and/or physical, and constantly evolve their attack tactics. Thus,having up-to-date and detailed information of APT’s tactics, techniques, and procedures (TTPs) facilitates thedesign of effective defense strategies as the focus of this paper. Specifically, we posit the importance oftaxonomies in categorizing cyber-attacks. Note, however, that existing information about APT attackcampaigns is fragmented across practitioner, government (including intelligence/classified), and academicpublications, and existing taxonomies generally have a narrow scope (e.g., to a limited number of APTcampaigns). Therefore, in this paper, we leverage the Cyber Kill Chain (CKC) model to “decompose” anycomplex attack and identify the relevant characteristics of such attacks. We then comprehensively analyze morethan 40 APT campaigns disclosed before 2018 to build our taxonomy. Such taxonomy can facilitate incidentresponse and cyber threat hunting by aiding in understanding of the potential attacks to organizations as wellas which attacks may surface. In addition, the taxonomy can allow national security and intelligence agenciesand businesses to share their analysis of ongoing, sensitive APT campaigns without the need to disclose detailedinformation about the campaigns. It can also notify future security policies and mitigation strategy formulation.
Abstract
The need for cyber resilience is increasingly important in our technology-dependent society where computingdevices and data have been, and will continue to be, the target of cyber-attackers, particularly advancedpersistent threat (APT) and nation-state/sponsored actors. APT and nation-state/sponsored actors tend to bemore sophisticated, having access to significantly more resources and time to facilitate their attacks, which inmost cases are not financially driven (unlike typical cyber-criminals). For example, such threat actors oftenutilize a broad range of attack vectors, cyber and/or physical, and constantly evolve their attack tactics. Thus,having up-to-date and detailed information of APT’s tactics, techniques, and procedures (TTPs) facilitates thedesign of effective defense strategies as the focus of this paper. Specifically, we posit the importance oftaxonomies in categorizing cyber-attacks. Note, however, that existing information about APT attackcampaigns is fragmented across practitioner, government (including intelligence/classified), and academicpublications, and existing taxonomies generally have a narrow scope (e.g., to a limited number of APTcampaigns). Therefore, in this paper, we leverage the Cyber Kill Chain (CKC) model to “decompose” anycomplex attack and identify the relevant characteristics of such attacks. We then comprehensively analyze morethan 40 APT campaigns disclosed before 2018 to build our taxonomy. Such taxonomy can facilitate incidentresponse and cyber threat hunting by aiding in understanding of the potential attacks to organizations as wellas which attacks may surface. In addition, the taxonomy can allow national security and intelligence agenciesand businesses to share their analysis of ongoing, sensitive APT campaigns without the need to disclose detailedinformation about the campaigns. It can also notify future security policies and mitigation strategy formulation.
참고문헌 (89)
- B. De Decker, "Communications and Multimedia Security (LNCS 8099)" (2014), Springer
- E. Cole, "Advanced Persistent Threat: Understanding the Danger and How to Protect Your Organization" (2013), Syngress
- L. Wang, "From Database to Cyber Security", pp.450~469 (2018), Springer
- "What is APT?" (2013)[URL]
- P. Chen, "Communications and Multimedia Security", pp.63~72 (2014), Springer
- "APT 30 and the mechanics of a long-running cyber espionage operation" (2015)[URL]
- I. M. Chapman, "Taxonomy of cyber attacks and simulation of their effects", Proceedings of the 2011 Military Modeling & Simulation Symposium, pp.73~80 (2011)
- S. Hansman, "A taxonomy of network and computer attacks", Computers & Security, 24(1), pp.31~43 (2005)
- Taxonomies of cyber adversaries and attacks: a survey of incidents and approaches, "C. A. Meyers", Lawrence Livermore National Lab, ~, pp.Report No. LLNL-TR-419041 (2009)
- C. Simmons, "AVOIDIT: a cyber attack taxonomy", Proceedings of the 9th Annual Symposium on Information Assurance (ASIA’14), pp.2~12 (2014)
- B. Zhu, "A taxonomy of cyber attacks on SCADA systems", Proceedings of 2011International Conference on Internet of Things and 4th International Conference on Cyber, Physical and Social Computing, pp.380~388 (2011)
- E. M. Hutchins, "Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains", Leading Issues in Information Warfare &Security Research, 1(1), pp.80~106 (2011)
- A. Lemay, "Survey of publicly available reports on advanced persistent threat actors", Computers & Security, 72, pp.26~59 (2018)
- N. Virvilis, "The big four-what we did wrong in advanced persistent threat detection?", Proceedings of 2013 International Conference on Availability, Reliability and Security, pp.248~254 (2013)
- M. Ussath, "Advanced persistent threats: behind the scenes", Proceedings of 2016 Annual Conference on Information Science and Systems (CISS), pp.181~186 (2016)
- T. Yadav, "Security in Computing and Communication", pp.438~452 (2015), Springer
- R. Derbyshire, "An analysis of cyber security attack taxonomies", Proceedings of 2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp.153~161 (2018)
- "Threat Group 3390 Cyberespionage" (2015)[URL]
- A. Chesla, "Cyber-security system and methods thereof", U. S. Patent 9565204, ~ (2017)
- G. O'Gorman, "The Elderwood Project" (2012), Symantec Corporation
- "Clandestine Fox, Part Deux" (2014)[URL]
- "APT1: exposing one of China’s cyber espionage units" (2013)[URL]
- "The MiniDuke mystery: PDF 0-day government spy assembler 0x29A micro backdoor" (2013)[URL]
- "Operation SMN: Axiom Threat Actor Group Report"[URL]
- K. Scarfone, "Guide to Intrusion Detection and Prevention Systems (IDPS)", National Institute of Standards and Technology, ~ (2012)
- A. Fuchsberger, "Intrusion detection systems and intrusion prevention systems", Information Security Technical Report, 10(3), pp.134~139 (2005)
- F. Casino, "HEDGE : efficient traffic classification of encrypted and compressed packets", IEEE Transactions on Information Forensics and Security, 14(11), pp.2916~2926 (2019)
- "NetTraveler is back: the ‘Red Star’ APT returns with new tricks" (2013)[URL]
- "Spear-phishing email: most favored APT attack bait" (2012)[URL]
- I. Ghafir, "Disguised executable files in spear-phishing emails: detecting the point of entry in advanced persistent threat", Proceedings of the 2nd International Conference on Future Networks and Distributed Systems (2018)
- "The Naikon APT and the MsnMM campaigns" (2015)[URL]
- Muhammad Shahzad, "Large Scale Characterization of Software Vulnerability Life Cycles", IEEE Transactions on Dependable and Secure Computing, pp.1~1 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- "Operation pawn storm using decoys to evade detection" (2014)[URL]
- "Operation wilted tulip: exposing a cyber-espionage apparatus" (2017)[URL]
- "Energetic Bear - Crouching Yeti" (2014)[URL]
- "Hidden Lynx - professional hackers for hire" (2013)[URL]
- "The Waterbug attack group" (2016)[URL]
- "Agent.btz: a threat that hit pentagon" (2008)[URL]
- "A look at the threats to air-gapped systems" (2017)[URL]
- M. Guri, "air-jumper: covert air-gap exfiltration", infiltration via security cameras &infrared (IR), 2019, pp.82, 15~29
- "APT28 under the scope" (2015)[URL]
- "Sednit espionage group attacking air-gapped networks" (2014)[URL]
- Q. Do, "The role of the adversary model in applied security research", Computers & Security, 81(156-181) (2018)
- S. O’Malley, "Bridging the air gap: Inaudible data exfiltration by insiders", Proceedings of the 20th Americas Conference on Information Systems (AMCIS), pp.7~10 (2014)
- "Sofacy’s ‘Komplex’ OS X Trojan" (2016)[URL]
- "The ProjectSauron APT" (2016)[URL]
- "ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms" (2016)[URL]
- Managing information security risk: organization, mission, and information system view, "R. S. Ross", National Institute of Standards and Technology, ~ (2011)
- "Less than zero: a survey of zero-day attacks in 2013 and what they say about the traditional security model" (2013)[URL]
- L. Ablon, "Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits" (2017), Rand Corporation
- L. Bilge, "Before we knew it: an empirical study of zero-day attacks in the real world", Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp.833~844 (2012)
- "Darwin’s Favorite APT Group" (2014)[URL]
- V. Kotov, "Engineering Secure Software and Systems", pp.181~196 (2013), Springer
- "Exploits: how great is the threat?" (2017)[URL]
- "CopyKittens Attack Group" (2015)[URL]
- "The increased use of powershell in attacks" (2016)[URL]
- "Operation ‘KE3CHANG’: Targeted Attacks against Ministries of Foreign Affairs" (2014)[URL]
- "Operation DeputyDog: Zero-Day (CVE-2013-3893) attack against Japanese targets" (2013)[URL]
- "Credential-based attacks: exposing the ecosystem and motives behind credential phishing, theft and abuse" (2017)[URL]
- "Hacker group creates network of fake LinkedIn profiles" (2015)[URL]
- "APT28: at the center of the storm" (2017)[URL]
- "Bears in the Midst: intrusion into the Democratic National Committee" (2016)[URL]
- C. Missaoui, "Cyberspace Safety and Security", pp.3~17 (2018), Springer
- M. S. Webb, "Evaluating tool based automated malware analysis through persistence mechanism detection", Ph.D., pp.2018
- "Operation ephemeral hydra: IE Zero-Day linked to DeputyDog uses diskless method" (2013)[URL]
- Y. M. Wang, "Gatekeeper:monitoring auto-start extensibility points (ASEPs) for spyware management", Proceedings of the 18th Large Installation System Administration Conference (LISA), pp.33~46 (2004)
- N. Miloslavskaya, "Remote attacks taxonomy and their verbal indicators", Procedia Computer Science, 123, pp.278~284 (2018)
- "Forkmeiamfamous: Seaduke, latest weapon in the Duke armory" (2015)[URL]
- Finding cyber threats with ATT&CK-based analytics, "B. E. Strom", The MITRE Corporation, ~, pp.Technical Report No. MTR170202 (2017)
- "Global energy cyberattacks: ‘Night Dragon’" (2011)[URL]
- "Ten process injection techniques: a technical survey of common and trending process injection techniques" (2017)[URL]
- "Working with the AppInit DLLs registry value" (2018)[URL]
- "DLL search order hijacking revisited" (2010)[URL]
- "Dynamic-link library search order" (2018)[URL]
- "Backdoor.Barkiofork targets aerospace and defense industry" (2013)[URL]
- "Backdoor.Barkiofork" (2013)[URL]
- "DLL side-loading: a thorn in the side of the anti-virus industry" (2016)[URL]
- "Threat Group 3390 cyberespionage" (2015)[URL]
- "Unit 42 Technical Analysis: Seaduke" (2015)[URL]
- "COM Object hijacking: the discreet way of persistence" (2014)[URL]
- "En route with Sednit" (2016)[URL]
- "Attacks before system startup" (2014)[URL]
- "Command & Control: Understanding, Denying and Detecting-A review of malware C2 techniques, detection and defences" (2014)[URL]
- Backdoor use in targeted attacks, "D. Chiu", Trend Micro Incorporated, ~ (2014)
- S. Shafieian, "Network and System Security", pp.112~127 (2017), Springer
- "Satellite Turla: APT command and control in the sky" (2015)[URL]
- "Mind the gap: are air-gapped systems safe from breaches?" (2014)[URL]
- "Flamer: highly sophisticated and discreet threat targets the Middle East" (2012)[URL]
- "Featured intelligence (Microsoft Security Intelligence Report Volume 19)" (2015)[URL]