연구동향 분석

ATT&CK 기반 공격체인 구성을 통한 APT 공격탐지 시스템 구현

조성영 박용우 이경식 2022년

논문상세정보
인용/피인용
' ATT&CK 기반 공격체인 구성을 통한 APT 공격탐지 시스템 구현' 의 주제별 논문영향력
논문영향력 선정 방법
논문영향력 요약
주제
  • Attack Chain
  • MITRE ATT&CK
  • Reconstruction
  • TTPs
  • apt
동일주제 총논문수 논문피인용 총횟수 주제별 논문영향력의 평균
222 0

0.0%

' ATT&CK 기반 공격체인 구성을 통한 APT 공격탐지 시스템 구현' 의 참고문헌

  • pfsense
  • auditd
  • Zeek
  • WATSON : Abstracting behaviors from audit logs via aggregation of contextual semantics
    Jun Zeng [2021]
  • Transparent Computing (Archived)
  • Tracking and analysis of causality at enterpriselevel(TRACE)
  • TTPs #6 Target Watering Hole Attack Strategy Analysis
  • Sysmon Config
  • Suricata
  • Sigma
  • STIX Version 2.1 Specification
  • STATL : An attack language for state-based intrusion detection
  • SLEUTH:Real-time attack scenario reconstruction from COTS audit data
  • Pupy
  • Probabilistic alert correlation
  • PoshC2
  • PEStudio
  • OSSEM Detection Model (DM)
  • Needle in a haystack : Mitigating content poisoning in named-data networking
    Cesar Ghali [2014]
  • Naval Information Warfare Systems Command (NAVWAR) Awards FireEye First Place in Network Threat Detection Challenge
  • Mitigating advanced and persistent threat(APT)damage by reasoning with provenance in large enterprise network(MARPLE)Program
    Josyula Rao [2020]
  • Microsoft Sysinternals Sysmon
  • Metasploit
  • Managing alerts in a multi-intrusion detection environment
  • MITRE ATT&CK, Data Source
  • MARS: multi-stage attack recognition system
  • M2D2 : A formal data model for IDS alert correlation
  • Kernel-supported cost-effective audit logging for causality tracking
    Shiqing Ma [2018]
  • HOLMES: Real-time APT detection through correlation of suspicious information flows
  • HERCULE : Attack story reconstruction via community discovery on correlated log graph
    Kexin Pei [2016]
  • Enriching intrusion alerts through multi-host causality
  • Enabling refinable cross-host attack investigation with efficient data flow tagging and tracking
    Yang Ji [2018]
  • Elastic Stack
  • Elastic Detection Ruels
  • Elastic Common Schema
  • ClearScope : Full stack provenance graph generation for transparent computing on mobile devices
  • Casual, adaptive, distributed, and efficient tracing system (CADETS)
  • CONAN : A practical real-time APT detection system With high accuracy and efficiency
  • CAR (Cyber Analytics Repostory)
  • Backtracking intrusions
  • Attack Flow
  • Analyzing intensive intrusion alerts via correlation
    Peng Ning [2002]
  • An online adaptive approach to alert correlation
    Hanli Ren [2010]
  • Alert correlation in a cooperative intrusion detection framework
  • Alert correlation for extracting attack strategies
    Bin Zhu [2006]
  • Aggregation and correlation of intrusion-detection alerts
  • Adversary Emulation Library
  • ATT&CK Evaluatio ns
  • ATT&CK
  • A diagnostics approach for persistence threat detection(ADAPT)
    Ryan Wright [2019]