In the present era, as dependence on the internet and virtual space has significantly increased, organizations and governments are facing numerous security challenges. One of the most critical challenges is sophisticated and targeted cyber attacks known as Advanced Persistent Threats (APTs). These attacks are carried out by skilled and organized groups with objectives such as espionage, data theft, or disruption of organizational activities. The complex, multi-faceted, multi-stage, and distributed nature of Advanced Persistent Threats makes their identification and mitigation a difficult task. Traditional methods of identifying APTs, such as antivirus detection systems and firewalls, are not effective in combating these attacks, highlighting the need for a novel approach in this field. Therefore, this research aims to propose a novel approach for identifying Advanced Persistent Threats based on the correlation between al‎e‎rts and clustering al‎e‎rts related to a potential APT. The proposed approach focuses on identifying APTs based on their complex, multi-stage, and distributed nature. Initially, tracking network and operating system events and generating corresponding al‎e‎rts based on attacker techniques is done by adding rules to the information management and security event system. The proposed approach, by collecting network and operating system events from all organization hosts, is capable of identifying combined and distributed persistent threats. Additionally, by utilizing correlation and clustering of al‎e‎rts, it can reconstruct chains of Advanced Persistent Threats. Finally, machine learning algorithms and deep learning will be used to predict Advanced Persistent Threats. To eva‎luate the proposed approach, a semi-real dataset simulating 14 real Advanced Persistent Threats has been created. The introduced approach successfully identified the chain of 14 Advanced Persistent Threats with a sensitivity and F-Score of 87.97 and 75.45, respectively, which is significant given the complexity of APTs. Furthermore, machine learning algorithms were able to predict Advanced Persistent Threat events with an accuracy of 97%, and deep learning algorithms with an accuracy of 85.9% for the techniques used in the subsequent stages of Advanced Persistent Threats.

علي فانيان

محمد دخيل عليان , مجتبي خليلي دليگاني