CY-Apollo: A Multi-view Profile System for Complicated Network Attacks

With the fast development of information technologies, many new variants of complicated network attacks, characterized by high covert, persistence, and diffusion, have made identifying and detecting such attacks increasingly difficult. Although many intrusion detection methods or products can help identify possible attack behaviors, it is still a challenging problem to detect complicated network attacks, such as the Advanced Persistent Threat (APT) attacks, which are composed of many single-step attacks. A portrait-based analysis method can provide a multi-view of the complicated attacks, such as the attack path and commonly adopted tools, thus can assist in improving the efficiency and accuracy of network attack detection. However, to the best of our knowledge, there does not exist such a profile system for these attacks. In our work, we first construct the attack profile model and define the expression specifications of attack profile data, then we establish the attack graph based on various types of attack element data, and ultimately generate the profile for different complicated attacks. Furthermore, we develop a multi-view profile system called CY-Apollo for different types of attacks. This system comprises four integral functional modules: data collection module, data preprocessing module, attack profile knowledge graph constructing module and attack profile knowledge management module. CY-Apollo gives the visualization of typical complicated network attacks from four different latitudes: attack principle view, panoramic event view, attack organization view and threat intelligence view, which can help industry professionals quickly understand, learn, and analyze existing complex and cross-domain attacks from multiple perspectives.