Combatting Advanced Persistent Threat via Causality Inference and Program Analysis

Yonghwi Kwon, Purdue University

Abstract

Cyber attackers are becoming more and more sophisticated. In particular, Advanced Persistent Threat (APT) is a new class of attack that targets a specific organization and compromises systems over a long time without being detected. Over the years, we have seen notorious examples of APTs including Stuxnet which disrupted Iranian nuclear centrifuges and data breaches affecting millions of users. Investigating APT is challenging as it occurs over an extended period of time and the attack process is highly sophisticated and stealthy. Also, preventing APTs is difficult due to ever-expanding attack vectors. In this dissertation, we present proposals for dealing with challenges in attack investigation. Specifically, we present \ldx which conducts precise counter-factual causality inference to determine dependencies between system calls (e.g., between input and output system calls) and allows investigators to determine the origin of an attack (e.g., receiving a spam email) and the propagation path of the attack, and assess the consequences of the attack. \ldx is four times more accurate and two orders of magnitude faster than state-of-the-art taint analysis techniques. Moreover, we then present a practical model-based causality inference system, \mci, which achieves precise and accurate causality inference without requiring any modification or instrumentation in end-user systems. Second, we show a general protection system against a wide spectrum of attack vectors and methods. Specifically, we present \atoc that prevents a wide range of attacks by randomizing inputs such that any malicious payloads contained in the inputs are corrupted. The protection provided by \atoc is both general (e.g., against various attack vectors) and practical (7\% runtime overhead).

Degree

Ph.D.

Advisors

Zhang, Purdue University.

Subject Area

Computer Engineering|Computer science

COinS