DETECTION OF ADVANCED PERSISTENT THREATS USING SIEM RULESETS

Abstract

Cyber-attacks move towards a sophisticated, destructive, and persistent position, as in the case of Stuxnet, Dark Hotel, Poseidon, and Carbanak. These attacks are called Advanced Persistent Threats (APT) in which an intruder establishes an undetected presence in a network in order to steal sensitive data over a prolonged period of time. In today's digitalized life, these attacks threaten the main critical life areas. This threat is followed by critical infrastructures, finance, energy, and aviation agencies. One of the biggest APT attacks was Stuxnet which targeted software on computers controlling the programmable logic controllers (PLCs) used to automate machine processes. The other one was the Deep Panda attack discovered in 2015 which compromised over 4 million US personnel records because of the ongoing cyberwar between China and the U.S. This paper attempts to explain the difficulties of detecting APTs and to examine the studies in this area. In addition, this paper presents a new approach to detecting APTs using the SIEM solution. In this approach, it is recommended to establish APT rulesets in SIEM solutions by using the indicators left behind by the attacks. In the rulesets, 3 basic indicator types are considered, and examples are shared. Keywords: Cyber security, cyber war, APT, SIEM, Intrusion Detection System.