UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats.

摘要: Advanced Persistent Threats (APTs) are difficult to detect due their "low-and-slow" attack patterns and frequent use of zero-day exploits. We present UNICORN, an anomaly-based APT detector that effectively leverages data provenance analysis. From modeling detection, UNICORN tailors its design specifically for the unique characteristics APTs. Through extensive yet time-efficient graph analysis, explores graphs provide rich contextual historical information identify stealthy anomalous activities without pre-defined signatures. Using a sketching technique, it summarizes long-running system execution with space efficiency combat slow-acting attacks take place over long time span. further improves detection capability using novel approach understand long-term behavior as evolves. Our evaluation shows outperforms existing state-of-the-art detects real-life scenarios high accuracy.