Advanced threat intelligence: detection and classification of anomalous behavior in system processes

被引：0

作者：

Luh, Robert ^{[1
]}

Schrittwieser, Sebastian ^{[1
]}

机构：

[1] Polten, Josef Ressel Zentrum TARGET, Matthias-Corvinus-Strasse 15, A-3100 St. Polten, Austria

来源：

ELEKTROTECHNIK UND INFORMATIONSTECHNIK | 2020年 / 137卷 / 01期

关键词：

malware; attack; anomaly detection;

D O I：

10.1007/s00502-019-00780-x

中图分类号：

TM [电工技术]; TN [电子技术、通信技术];

学科分类号：

0808 ; 0809 ;

摘要：

With the advent of Advanced Persistent Threats (APTs), it has become increasingly difficult to identify and understand attacks on computer systems. This paper presents a system capable of explaining anomalous behavior within network-enabled user sessions by describing and interpreting kernel event anomalies detected by their deviation from normal behavior. The prototype has been developed at the Josef Ressel Center for Unified Threat Intelligence on Targeted Attacks (TARGET) at St. Polten University of Applied Sciences.

引用

页码：38 / 44

页数：7