OSTINATO：通过攻击活动相似性检测实现跨主机攻击关联
OSTINATO: Cross-host Attack Correlation Through Attack Activity Similarity Detection
AI总结：
针对企业网络中跨多主机攻击难关联的问题，提出基于攻击战术技术相似性的跨主机关联方法Ostinato，无需横向移动检测，可检出更多失陷主机并大幅减少告警。
摘要：
针对企业的现代攻击通常在企业网络内部有多个目标。由于这些网络规模庞大，且攻击日益隐蔽，在威胁狩猎过程中，跨越多台主机的攻击者活动极难关联起来。本文提出了一种可在多台主机间高效实现跨主机攻击关联的方法。与以往研究不同，该方法无需横向移动检测技术，也无需对主机进行层级修改。相反，本方法基于一项观察：攻击者在其入侵的每台主机上都有少数战略性任务目标，且实现这些目标的技术屈指可数。该方法的核心思路是比较不同主机上（与操作系统无关）的活动，将展现出相似战术、技术和程序使用特征的主机关联起来。我们将该方法实现为名为Ostinato的工具，并在两类场景中成功完成评估：一类是由DARPA主导的红队演练威胁狩猎场景，涉及500台主机；另一类是多主机攻击场景。Ostinato成功检测出21台额外的失陷主机，这些主机被底层基于主机的检测系统在持续多日的攻击活动中遗漏。此外，Ostinato成功将底层检测系统生成的告警减少了90%以上，从而有助于缓解威胁告警疲劳问题。
英文摘要：
Modern attacks against enterprises often have multiple targets inside the enterprise network. Due to the large size of these networks and increasingly stealthy attacks, attacker activities spanning multiple hosts are extremely difficult to correlate during a threat-hunting effort. In this paper, we present a method for an efficient cross-host attack correlation across multiple hosts. Unlike previous works, our approach does not require lateral movement detection techniques or host-level modifications. Instead, our approach relies on an observation that attackers have a few strategic mission objectives on every host that they infiltrate, and there exist only a handful of techniques for achieving those objectives. The central idea behind our approach involves comparing (OS agnostic) activities on different hosts and correlating the hosts that display the use of similar tactics, techniques, and procedures. We implement our approach in a tool called Ostinato and successfully evaluate it in threat hunting scenarios involving DARPA-led red team engagements spanning 500 hosts and in another multi-host attack scenario. Ostinato successfully detected 21 additional compromised hosts, which the underlying host-based detection system overlooked in activities spanning multiple days of the attack campaign. Additionally, Ostinato successfully reduced alarms generated from the underlying detection system by more than 90%, thus helping to mitigate the threat alert fatigue problem
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
