APT Detection with Host-Based Intrusion Detection System and Intelligent Systems

Abstract

Recently, Advanced Persistent Threat (APT) attacks have targeted many institutions, such as governments and companies. APT refers to a type of offensive attacks, which have been performed for a long time using unique attack vectors and malware specifically developed for the target organization. Due to its complicated and sophiscated nature, this threat can be very hard to detect compared to other types of attacks. In this paper, we propose a new method to detect APT attacks by profiling user activities based on Indicator of Compromise (IOC) and chasing malware activities.