In recent years, a new category of cyber attacks has been developed under the name of Advanced Persistent Threats, which is a new and more sophisticated version of multi-stage attacks. The attackers of these attacks are organized groups with significant budgets and resources. APT is a complex, multi-stage, long-term, distributed and hybrid attack. The aim of these attacks is often espionage and information theft of communication and information systems of government, military and industrial organizations. Due to the complexity and specific characteristics of APT, traditional intrusion detection systems are mostly unable to detect them. Therefore; In this thesis, an attempt has been made to present a method for the real-time detection of APT using the correlation of al‎e‎rts. The focus of the presented method is on long-term, distributed, and hybrid APT detection. For this purpose, in the proposed solution after collecting all network and operating system level events; By using the set of defined rules, al‎e‎rts about the occurrence of attackers' techniques in APT steps have been generated. Then, to store and check the correlation between al‎e‎rts in this solution, the codebook data structure has been used. The use of this data structure has greatly helped in reducing the processing time and memory consumption of the attack detection process. In this research, the eva‎luation of the proposed method has been done in the form of four experiments with different objectives. On average, the values of recall, false positive rate, and accuracy in four different tests were equal to 85.4%, 1.73%, and 86%, respectively. Given the complexity of the APT, the amounts obtained have been significant.

علي فانيان

پروين رستگاري , محمد دخيل عليان