论文标题
独角兽：基于运行时出处的探测器，用于高级持续威胁
UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats
论文作者
论文摘要
高级持续威胁（APT）由于其“低和慢”攻击模式以及频繁使用零日的利用，因此很难检测到。我们提出了Unicorn，这是一种基于异常的APT检测器，可有效利用数据出处分析。从建模到检测，独角兽专门针对APT的独特特征量身定制设计。通过广泛但耗时的图形分析，Unicorn探索了出处图，这些图形提供了丰富的上下文和历史信息，以识别隐性的异常活动，而无需预先定义的攻击签名。使用图形草图技术，它总结了长期运行的系统执行，并用空间效率来应对长时间跨度发生的慢速攻击。独角兽进一步使用一种新型的建模方法来进一步提高其检测能力，以理解系统的长期行为。我们的评估表明，独角兽的表现胜过现有的最新APT检测系统，并以高度准确性检测现实生活中的APT场景。
Advanced Persistent Threats (APTs) are difficult to detect due to their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling to detection, UNICORN tailors its design specifically for the unique characteristics of APTs. Through extensive yet time-efficient graph analysis, UNICORN explores provenance graphs that provide rich contextual and historical information to identify stealthy anomalous activities without pre-defined attack signatures. Using a graph sketching technique, it summarizes long-running system execution with space efficiency to combat slow-acting attacks that take place over a long time span. UNICORN further improves its detection capability using a novel modeling approach to understand long-term behavior as the system evolves. Our evaluation shows that UNICORN outperforms an existing state-of-the-art APT detection system and detects real-life APT scenarios with high accuracy.
