ATDetector: A Thorough Pipeline to Detect Diverse APT Behaviors

Provenance graph-based approaches have become a promising solution for detecting advanced persistent threats (APTs). Particularly, analysts can model prior knowledge of acknowledged campaign as query graphs and extract potential APT behaviors through inexact graph matching. However, existing works are shown to be limited for ignoring the importance of extracting cross-graph semantic correlation information between provenance and query graphs, as well as aligning the information level of them. Thus, in this paper, we propose a novel and thorough pipeline for APT detection, including automatic query graph construction, fine-granularity detection through graph matching, and attack behavior reconstruction. Compared to existing works, our method reduces the manual involvement in query graph construction and can detect attack techniques used by attackers. Our experimental results demonstrate that our method can outperform state-of-the-arts by a wide margin.