ProblemChild：基于父子进程关系的异常模式发现
ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships
摘要：
越来越常见的是，对手攻击不仅仅包括一个独立的可执行文件或脚本。通常，攻击的证据包括可能被传统静态机器学习模型忽略的明显的过程遗产。高级攻击者技术，如“生活在陆地上”，孤立地看起来很正常，但在父子上下文中观察时变得更加可疑。从父子进程链导出的上下文可以帮助识别和分组恶意软件家族，以及发现新颖的攻击者技术。攻击者将这些技术链接起来以实现持久性，绕过防御并执行操作。传统的基于入侵检测的检测通常会产生属于构成单一攻击的噪声或不同事件。ProblemChild是一个基于图的框架，旨在解决这些问题。ProblemChild应用一个监督学习分类器来导出一个加权图，用于将看似不同的事件社区识别为更大的攻击序列。ProblemChild应用条件概率自动对异常社区进行排名，并抑制常见的父子链。结合起来，这个框架可以被分析师用来帮助制作或调整检测器，并随着时间的推移减少误报。我们针对APT3攻击的2018年MITRE ATT&CK（TM）仿真评估了ProblemChild，以证明其在识别异常父子进程链方面的前景。
英文摘要：
It is becoming more common that adversary attacks consist of more than a standalone executable or script. Often, evidence of an attack includes conspicuous process heritage that may be ignored by traditional static machine learning models. Advanced attacker techniques, like "living off the land" that appear normal in isolation become more suspicious when observed in a parent-child context. The context derived from parent-child process chains can help identify and group malware families, as well as discover novel attacker techniques. Adversaries chain these techniques to achieve persistence, bypass defenses, and execute actions. Traditional heuristic-based detections often generate noise or disparate events that belong to what constitutes a single attack. ProblemChild is a graph-based framework designed to address these issues. ProblemChild applies a supervised learning classifier to derive a weighted graph used to identify communities of seemingly disparate events into larger attack sequences. ProblemChild applies conditional probability to automatically rank anomalous communities as well as suppress commonly occurring parent-child chains. In combination, this framework can be used by analysts to aid in the crafting or tuning of detectors and reduce false-positives over time. We evaluate ProblemChild against the 2018 MITRE ATT&CK(TM) emulation of APT3 attack to demonstrate its promise in identifying anomalous parent-child process chains.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
