Distributed Detection of APTs: Consensus vs. Clustering

Abstract

Advanced persistent threats (APTs) demand for sophisticated traceability solutions capable of providing deep insight into the movements of the attacker through the victim’s network at all times. However, traditional intrusion detection systems (IDSs) cannot attain this level of sophistication and more advanced solutions are necessary to cope with these threats. A promising approach in this regard is Opinion Dynamics, which has proven to work effectively both theoretically and in realistic scenarios. On this basis, we revisit this consensus-based approach in an attempt to generalize a detection framework for the traceability of APTs under a realistic attacker model. Once the framework is defined, we use it to develop a distributed detection technique based on clustering, which contrasts with the consensus technique applied by Opinion Dynamics and interestingly returns comparable results.

A Correctness Proof of the Clustering Detection Approach

This section presents the correctness proof of the consensus-based detection, both the location and accumulative approach. This problem is solved when these conditions are met:

• 1. The attacker is able to find an IT/OT device to compromise within the infrastructure.

• 2. The traceability solution is able to identify an affected node, thanks to the clustering mechanism and fulfilling O1.

• 3. The detection can continuously track the evolution of the APT and properly finish in a finite time (termination condition), complying with O2 and O3.

The first requirement is satisfied under the assumption that the attacker breaks into the network and then moves throughout the topology following a finite path, according to the model explained in Sect. 4.2. Thus, an APT is defined as at least one sequence of attack stages against the network defined by G(V, E). If we study each of these traces independently, and based on the distribution of G, the attacker can either compromise the current node $v_i$ in the chain (as well as performing a data exfiltration or destruction) or propagate to another $v_j \in V$, whose graph is connected by the means of firewalls, according to the interconnection methodology illustrated in  [5] and summarized in Sect. 4.1.

As for the second requirement, it is met with the correlation of anomalies generated by agents in each attack phase. As presented with the attacker model, the value of these anomalies are determined in a probabilistic manner, depending on two possible causes: (1) the severity of the attack suffered and the criticality of the concerned resource; or (2) an indirect effect caused by another attack in the vicinity of the monitored node. Either way, the O1 correlation helps to actually determine whether the attack has been effectively perpetrated against that node, or it belongs to another APT stage in its surroundings. This information is deduced from the combination of I2 (the contextual information) together with these anomalies (i.e., I1), by using K-means to group these nodes and associate them with actual attacks.

We can easily demonstrate the third requirement (i.e., the termination of the approach) through induction. To do so, we specify the initial and final conditions as well as the base case:

• Precondition: we assume the attacker models an APT against the network defined by graph G(V, E) where $V\ne \oslash$, following the behaviour explained in Algorithm 1. On the other hand, the detection solution based on clustering can firstly sense the individual anomalies in every distributed agent, hence computing I1 and I2.

• Postcondition: the attacker reaches at least one node in G(V, E) and continues to execute all stages until $attackSet=\oslash$ in Algorithm 1. Over these steps, it is possible to visualize the threat evolution across the infrastructure, following the procedure described in Algorithm 2 in the case of accumulative clustering, and running K-means with both I1 and spatial information, in the case of location-based clustering.

• Case 1: the adversary intrudes the network and takes control of the first node $v_i \in V$, and both clustering approaches cope with the scenario of grouping healthy nodes apart from the attacked node. This is calculated by the K-means algorithm within a finite time, by iteratively assigning data items to clusters and recomputing the centroids.

• Case 2: the adversary propagates from a device node $v_i$ to another $v_j$, so that there exist $(v_i,v_j) \in E$. In this case, the correlation with K-means aims to group both affected nodes within the same cluster, which can be visualized graphically. As explained before, this is influenced by the attack notoriety and the closeness in the anomalies sensed by their respective agents (i.e., the threshold $\epsilon$ in Algorithm 2), as well as extra information given by I2.

• Induction: if we assume the presence of $k\ge 1$ APTs in the network, each one will consider Case 1 at the beginning and will separately consider Case 2 until $attackSet=\oslash$ for all k, ensuring the traceability of the threat and complying with the postcondition. Eventually, these APTs could affect the same subset of related nodes in G, which is addressed by the K-means to correlate the distribution of anomalies (again, attempting to distinguish between attacked nodes and devices that may sense side effects), in a finite time.

This way, we demonstrate the validity of the approach, since it finishes and it is able to trace the threats accordingly.