Advanced Persistent Threats (APTs) are sophisticated multi-step attacks, planned and executed by skilled adversaries targeting modern government and enterprise networks. Intrusion Detection Systems (IDSs) and User and Entity Behavior Analytics (UEBA) are commonly employed to aid a security analyst in the detection of APTs. The prolonged nature of APTs, combined with the granular focus of UEBA and IDS, results in overwhelming the analyst with an increasingly impractical number of alerts. Consequent to this abundance of data, and together with the crucial importance of the problem as well as the high cost of the skilled personnel involved, the problem of APT detection becomes a perfect candidate for automation through Artificial Intelligence (AI). In this paper, we provide, up to our knowledge, the first study and implementation of an end-to-end AI-assisted architecture for detecting APTs -- RANK. The goal of the system is not to replace the analyst, rather, it is to automate the complete pipeline from data sources to a final set of incidents for analyst review. The architecture is composed of four consecutive steps: 1) alert templating and merging, 2) alert graph construction, 3) alert graph partitioning into incidents, and 4) incident scoring and ordering. We evaluate our architecture against the 2000 DARPA Intrusion Detection dataset, as well as a read-world private dataset from a medium-scale enterprise. Extensive results are provided showing a three order of magnitude reduction in the amount of data to be reviewed by the analyst, innovative extraction of incidents and security-wise scoring of extracted incidents.
MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning
Fudan University（复旦大学）；Sun Yat-sen University（中山大学）；National Key Laboratory of Science and Technology on Information System Security（国家信息系统安全科学技术重点实验室）；Shanghai University of Electric Power（上海电力大学）
Synthetic APTs: the Collapse of TTP-Based Attribution
Alias Robotics（Alias机器人公司）；University of Naples Federico II（那不勒斯斐迪南二世大学）；Johannes Kepler University Linz（林茨约翰内斯·开普勒大学）；CYBER RANGES（网络靶场）；PurpleAILAB（PurpleAI实验室）
JailbreakOPT: Iterative Jailbreak Prompt Optimization with Macro-Action
University of California, Davis（加州大学戴维斯分校）；The Renmin University of China（中国人民大学）；Independent Researcher（独立研究员）；Nankai University（南开大学）；Cornell University（康奈尔大学）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））
