Sleuth: Real-time attack scenario reconstruction from COTS audit data

Md Nahid Hossain; Sadegh M. Milajerdi; Junao Wang; Birhanu Eshete; Rigel Gjomemo; R. Sekar; Scott D. Stoller; V. N. Venkatakrishnan

Sleuth: Real-time attack scenario reconstruction from COTS audit data

Md Nahid Hossain
, Sadegh M. Milajerdi
, Junao Wang
, Birhanu Eshete
, Rigel Gjomemo
, R. Sekar
, Scott D. Stoller
, V. N. Venkatakrishnan

Computer Science

Stony Brook University
University of Illinois at Chicago

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

330 Scopus citations

Abstract

We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team’s attacks on hosts running Windows, FreeBSD and Linux.

Original language	English
Title of host publication	Proceedings of the 26th USENIX Security Symposium
Publisher	USENIX Association
Pages	487-504
Number of pages	18
ISBN (Electronic)	9781931971409
State	Published - 2017
Event	26th USENIX Security Symposium, USENIX Security 2017 - Vancouver, Canada Duration: Aug 16 2017 → Aug 18 2017

Publication series

Name	Proceedings of the 26th USENIX Security Symposium

Conference

Conference	26th USENIX Security Symposium, USENIX Security 2017
Country/Territory	Canada
City	Vancouver
Period	08/16/17 → 08/18/17

Cite this

@inproceedings{e30c876a42534ff8a59aa4cf091b1aeb,

title = "Sleuth: Real-time attack scenario reconstruction from COTS audit data",

abstract = "We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team{\textquoteright}s attacks on hosts running Windows, FreeBSD and Linux.",

author = "Hossain, \{Md Nahid\} and Milajerdi, \{Sadegh M.\} and Junao Wang and Birhanu Eshete and Rigel Gjomemo and R. Sekar and Stoller, \{Scott D.\} and Venkatakrishnan, \{V. N.\}",

note = "Publisher Copyright: {\textcopyright} 2017 by The USENIX Association. All Rights Reserved.; 26th USENIX Security Symposium, USENIX Security 2017 ; Conference date: 16-08-2017 Through 18-08-2017",

year = "2017",

language = "English",

series = "Proceedings of the 26th USENIX Security Symposium",

publisher = "USENIX Association",

pages = "487--504",

booktitle = "Proceedings of the 26th USENIX Security Symposium",

}

Hossain, MN, Milajerdi, SM, Wang, J, Eshete, B, Gjomemo, R, Sekar, R , Stoller, SD & Venkatakrishnan, VN 2017, Sleuth: Real-time attack scenario reconstruction from COTS audit data. in Proceedings of the 26th USENIX Security Symposium. Proceedings of the 26th USENIX Security Symposium, USENIX Association, pp. 487-504, 26th USENIX Security Symposium, USENIX Security 2017, Vancouver, Canada, 08/16/17.

Sleuth: Real-time attack scenario reconstruction from COTS audit data. / Hossain, Md Nahid; Milajerdi, Sadegh M.; Wang, Junao et al.
Proceedings of the 26th USENIX Security Symposium. USENIX Association, 2017. p. 487-504 (Proceedings of the 26th USENIX Security Symposium).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Sleuth

T2 - 26th USENIX Security Symposium, USENIX Security 2017

AU - Hossain, Md Nahid

AU - Milajerdi, Sadegh M.

AU - Wang, Junao

AU - Eshete, Birhanu

AU - Gjomemo, Rigel

AU - Sekar, R.

AU - Stoller, Scott D.

AU - Venkatakrishnan, V. N.

PY - 2017

Y1 - 2017

N2 - We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team’s attacks on hosts running Windows, FreeBSD and Linux.

AB - We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team’s attacks on hosts running Windows, FreeBSD and Linux.

UR - https://www.scopus.com/pages/publications/85047110847

M3 - Conference contribution

AN - SCOPUS:85047110847

T3 - Proceedings of the 26th USENIX Security Symposium

SP - 487

EP - 504

BT - Proceedings of the 26th USENIX Security Symposium

PB - USENIX Association

Y2 - 16 August 2017 through 18 August 2017

ER -

Sleuth: Real-time attack scenario reconstruction from COTS audit data

Abstract

Publication series

Conference

Other files and links

Fingerprint

Cite this