Identifying APT Attack Stages Using Anomaly Score Calibration

APT breaches can go undetected for long periods because of the hackers' ability to adapt to and escape defensive methods. In this paper, we present a new approach to establishing whether a security event is part of an APT attack by predicting the corresponding kill chain stage. For monitored security activity and events, the approach derives a probabilistic anomaly score using an approach based on principal component analysis (PCA) and score calibration and classifying the event with a multiclass type of Bayesian Network (BN). The proposed model was evaluated using two different public APT datasets, which yielded very encouraging performance in accurately detecting APT event occurrences and stages.