Multi-agent System For Advanced Persistent Threat Detection

Intrusion Detection Incident Response

This project is the followup of DAP/20-03.

Contrary to currently available intrusion detection system (IDS) solutions, the MASFAD framework focuses on the use of domain knowledge of the structure of attacks and their behavior, with regards to emergent threats. The system implements analysis algorithms, which analyze the data collected from various sources in the network and look for specific Advanced Persistent Threat (APT) characteristics, producing evidence which is aggregated together, producing a “suspiciousness” score, to be reviewed by a domain expert. The analyst in turn can use their domain knowledge as well as context information, injected by the platform into the data, to decide what can be considered a threat and what is not. The analysis algorithms are encapsulated in different detection modules, or “agents”, each of which is designed to automate the detection of specific APT characteristic, related to abnormal behavior. The MASFAD architecture allows for the integration of new agents in a plug-and-play fashion. All agents act as a black box, ingesting raw data and producing relevant evidence through appropriate analysis. Since each agent depends on a list of parameters to define how the analysis will be handled, fine-tuning them is relatively easy. Indeed, this offers powerful capabilities to deploy the same type of agent, with focus on different indicators of abnormal activity as prescribed by their parameter values. So far we have incorporated machine-learning algorithms for regulating the aggregation of the evidences by observing the results produced and adapting the parameters of the aggregation accordingly.

Currently, the MASFAD framework has shown during testing high true detection rate of malicious threats. Our goal is to continue the development of the system by focusing on three major aspects:

1. evaluating the MASFAD framework within the CSOC, using feedback from analysts to improve the detection capabilities;
2. reducing the amount of false positives generated by the detection by tuning the agents parameters to test perfromed with operational data;
3. continuing the development of machine-learning algorithms, which will help to train the different detection agents to self-regulate, adapting to the data sources provided.

Publications

• Georgi Nikolov, Margaret Varga, Susan Träber Burdin, Carsten Winkelholz, Kaur Kullman and Valérie Lavigne. 2024. Visualization for Cyber Complex Systems: Application, Issues and Future Work. Digital Transformation, Cybersecurity, And Resilience DIGILIENCE 2024