Towards a security provenance based framework on analyzing root cause of enterprise network security incidents

Abstract

Nowadays, modern enterprise infrastructures include many diverse heterogeneous systems (e.g., router and host) to operate various kinds of services (e.g., web and email). This diversity and heterogeneity make network administrators very hard to track/monitor sophisticated attack trials, such as APTs adopting multiple attack vectors. To overcome this challenge (i.e., provide network operators with clear views on attack trials), we introduce a new concept of security provenance, enabling us to discover the root cause of security incidents effectively. Based on this concept, we build a prototype implementation of SecTracer as a new security analysis framework. SecTracer brings three key contributions: (i) comprehensive and efficient forensic data collection in a dynamic network environment, (ii) attack history reconstruction to deliver a blueprint of cyber-crimes, and (iii) active attack prediction by leveraging graph-based relational learning. In addition, we demonstrate its effectiveness and efficiency by showing analysis capabilities with simulation of real-world APT attack scenario on the enterprise network.