Publication | Closed Access
{SLEUTH}: Real-time Attack Scenario Reconstruction from {COTS} Audit Data
47
Citations
0
References
2017
Year
EngineeringInformation SecurityInformation ForensicsSoftware EngineeringSoftware AnalysisReal-time ReconstructionAttack SimulationData ScienceAttack ScenariosIntrusion Detection SystemKnowledge DiscoveryComputer ScienceAudit DataAttack GraphSecurity AuditData SecuritySecurity VisualizationLog AnalysisProgram AnalysisAttack ModelSoftware TestingBusinessEnterprise Host
The authors propose a real‑time system to reconstruct attack scenarios on enterprise hosts. They implement a platform‑neutral, in‑memory dependency‑graph abstraction of audit logs, coupled with tag‑based detection, source identification, impact analysis, and compact visual graph construction to reconstruct attacks. The system successfully detected and reconstructed the red team’s attacks on Windows, FreeBSD, and Linux hosts during a DARPA evaluation.
We present an approach and system for real-time reconstruction of attack scenarios on an enterprise host. To meet the scalability and real-time needs of the problem, we develop a platform-neutral, main-memory based, dependency graph abstraction of audit-log data. We then present efficient, tag-based techniques for attack detection and reconstruction, including source identification and impact analysis. We also develop methods to reveal the big picture of attacks by construction of compact, visual graphs of attack steps. Our system participated in a red team evaluation organized by DARPA and was able to successfully detect and reconstruct the details of the red team's attacks on hosts running Windows, FreeBSD and Linux.