Towards Event Aggregation for Reducing the Volume of Logged Events During IKC Stages of APT Attacks

Targeted attacks like Advanced Persistent Threats (APTs) have become a primary concern of many enterprise networks. As a common approach to counter these attacks, security staff deploys various security and non-security sensors at different lines of defense (Network, Host, and Application) to track the attacker's behaviors during their kill chain. However, one of the drawbacks of this approach is the massive amount of events raised by heterogeneous security and non-security sensors. The bulk logged events makes it challenging to analyze them for later processing, i.e., event correlation for timely detection of APT attacks. Some research papers have been published on event aggregation to reduce the volume of logged low-level events. However, most research works have provided a method to aggregate the events of a single-type and homogeneous event source, i.e., NIDS. In addition, their main focus is only on the degree to which the event volume is reduced. At the same time, the amount of security information lost during the event aggregation process is also significant. In this paper, we propose a three-phase event aggregation method to reduce the volume of logged heterogeneous events during APT attacks, considering the lowest rate of loss of security information. To this aim, the sensors' low-level events are first clustered into similar event groups. Then, after filtering noisy event clusters, the remaining clusters are summarized based on an Attribute-Oriented Induction (AOI) method in a controllable manner to reduce the unimportant or duplicated events. The method has been evaluated on the three publicly available datasets: SotM34, Bryant, and LANL. The experimental results show that the method is efficient enough in event aggregation and can reduce event volume up to 99.7% with an acceptable information loss ratio (ILR) level. (c) 2023 ISC. All rights reserved.