Сybernetic model of the advanced persisten threat

Abstract

The widespread use of sophisticated cyberattacks such as Advanced Persisten Threat with regard to critical infrastructure has become a powerful incentive for the development of proactive cyber defense techniques. Typical for APTs are a complex action set of malicious actor that are related time and space. Separately, these actions may not cause suspicion; targeted attack actions on the cyber segment of the victim object is being prepared for a long time (from a few months to a year or more); a set of actions of the intruder are a chain of tactics, the execution of which allows to achieve the purpose of the attack. Means of implementing tactics are varied. The set of tactics and their essence remain constant. Most of the known models of APT attacks are presented in the form of a verbal description of the stages of the APT and their semantic content. The disadvantage of such models is the impossibility of direct application in the SIEM due to the lack of a common basis for the algorithmization of actions during the attack stages. At the base of another group of models are different mathematical constructions that allow one to represent large-scale actions of an attacker in the form of one complex mathematical process. As a rule, such models are difficult to associate with technological processes for monitoring events in real time. From the standpoint of automating the detection of attacks, the first task is to develop such APT models that allow you to algorithmize the process of generating compromise indicators based on a reasoned correlation of events over time and space. The article is devoted to the development of a new model of APT based on a cybernetic approach. This allows you to imagine an attack in the form of a behavior trajectory of a controlled (cybernetic) system. Within the framework of the model, the behavior of the attacker cybernetic system was presented through a mathematical description of information management processes and the iterative relationship between adjacent phases (states) of the cybernetic system. This approach allows the attack to be presented in the form of a hierarchical structure: the upper level is a sequence of verbal stages of an attack; the middle level is a sequence of phases of the cybernetic system; lower level is a sequence of control loop procedures. Procedures are elementary events (transmitted data and computational processes) that are detected by security sensors at the nodes of a computer network. The model allows us to represent each attack as a set of interrelated characteristics of elementary events at the nodes of a computer network. Such a set (APT pattern) can be applied within the framework of automated attack detection using SIEM tools in proactive cyber defense systems.