Pivot Attack Classification for Cyber Threat Intelligence

Rafael Salema Marques; Haider al-Khateeb; Gregory Epiphaniou; Carsten Maple

doi:10.26735/ZNTL3639

PDF (English)

منشور 03-10-2022

DOI https://doi.org/10.26735/ZNTL3639

كيفية الاقتباس

[1]

"Pivot Attack Classification for Cyber Threat Intelligence", JISCR, م 5, عدد 2, ص 91–103, أكتوبر 2022, doi: 10.26735/ZNTL3639.

تنزيل الاقتباسات

Rafael Salema Marques

School of Engineering, Computing and Mathematical Sciences, University of Wolverhampton, Wolverhampton, UK

Haider al-Khateeb

School of Engineering, Computing and Mathematical Sciences, University of Wolverhampton, Wolverhampton, UK

https://orcid.org/0000-0001-8944-123X (غير مصرح له) Gregory Epiphaniou3

Warwick Manufacturing Group (WMG), The University of Warwick, Coventry, UK

Carsten Maple

Warwick Manufacturing Group (WMG), The University of Warwick, Coventry, UK.

الملخص

The initial access achieved by cyber adversaries conducting a systematic attack against a targeted network is unlikely to be an asset of interest. Therefore, it is necessary to use lateral movement techniques to expand access to different devices within the network to accomplish the strategic attack’s objectives. The pivot attack technique is widely used in this context; the attacker creates an indirect communication tunnel with the target and uses traffic forwarding methods to send and receive commands. Recognising and classifying this technique in large corporate networks is a complex task, due to the number of different events and traffic generated. In this paper, we present a pivot attack classification criteria based on perceived indicators of attack (IoA) to identify the level of connectivity achieved by the adversary. Additionally, an automatic pivot classifier algorithm is proposed to include a classification attribute to introduce a novel capability for the APIVADS pivot attack detection scheme. The new algorithm includes an attribute to differentiate between types of pivot attacks and contribute to the threat intelligence capabilities regarding the adversary modus operandi. To the best of our knowledge, this is the first academic peer-reviewed study providing a pivot attack classification criteria.

الكلمات المفتاحية

Pivoting، Cybersecurity، Classification، Flow-Based Analysis، Lateral Movement، Pivot Attack

التنزيلات

تنزيل البيانات ليس متاحًا بعد.

السير الشخصية للمؤلفين

Rafael Salema Marques

Rafael Salema Marques is a cyber security researcher. Graduated as a military pilot by the Brazilian Air Force Academy in 2001. Received his MSc degree in Computer Engineering focusing on cyber security from ITA (Instituto Tecnol´ogico de Aeron´autica) in 2016. Currently a PhD student at the University of Wolverhampton. His subjects of interest are related to command and control architectures, offensive security, malware detection, Artificial Intelligence and threat hunting.

Haider al-Khateeb

حيدر الخطيب

مدرسة الهندسة ، علوم الكمبيوتر والرياضيات ، جامعة ولفرهامبتون، ولفرهامبتون، المملكة المتحدة.

Gregory Epiphaniou3

Gregory Epiphaniou received the Ph.D. degree from the University of Bedfordshire, U.K., in 2010. He is currently an Associate Professor of security engineering at the University of Warwick. His role involves bid support, applied research, publications and teaching. He led and contributed to several research projects funded by EPSRC, IUK and local authorities totalling over £8M.

Carsten Maple

Carsten Maple received the Ph.D. from the University of Leicester, U.K., in 1998. He is currently a Professor of Cyber Systems Engineering with WMG’s Cyber Security Centre. He is the Director of research in Cyber Security working with organisations in key sectors such as manufacturing, healthcare, and the broader public sector to address the challenges presented by today’s cyber environment.

المراجع

M. Ussath, D. Jaeger, Feng Cheng, and C. Meinel, “Advanced persistent threats: Behind the scenes,” in 2016 Annu. Conf. Inf. Sci. Syst. (CISS), 2016, pp. 181-186, doi: 10.1109/CISS.2016.7460498.

MITRE, “Adversarial tactics, techniques and common knowledge,” 2020. [Online]. Available: https://attack.mitre.org/

A. Greco, G. Pecoraro, A. Caponi, and G. Bianchi, “Advanced Widespread Behavioral Probes against Lateral Movements,” Int. J. Inf. Secur. Res., vol. 6, no. 2, pp. 651-659, June 2016, doi: 10.20533/ijisr.2042.4639.2016.0075.

G. Apruzzese, F. Pierazzi, M. Colajanni, and M. Marchetti, “Detection and Threat Prioritization of Pivoting Attacks in Large Networks,” IEEE Trans. Emerg. Topics Comput., vol. 8, no. 2, pp. 404-415, 1 April-June 2020, doi: 10.1109/TETC.2017.2764885.

C. Cimpanu, “NASA hacked because of unauthorized Raspberry Pi connected to its network,” June 21, 2019. [Online]. Available: https://www.zdnet.com/article/nasa-hacked-because-of-unauthorized-raspberry-pi-connected-to-its-network

R. S. Marques, H. Al-Khateeb, G. Epiphaniou, and C. Maple, “APIVADS: A Novel Privacy-Preserving Pivot Attack Detection Scheme Based on Statistical Pattern Recognition,” IEEE Trans. Inf. Forensics Secur., vol. 17, pp. 700-715, 2022, doi: 10.1109/TIFS.2022.3146076.

W. W. Tounsi and H. Rais, “A survey on technical threat intelligence in the age of sophisticated cyber attacks,” Comput. Secur., vol. 72, pp. 212-233, Jan. 2018, doi: 10.1016/j.cose.2017.09.001.

K. Paine and O. Whitehouse, “Indicators of Compromise (IoCs) and Their Role in Attack Defence draft-paine-smart-indicators-of-compromise-00-,” Mar. 6, 2020. [Online]. Available: https://datatracker.ietf.org/doc/draft-paine-smart-indicators-of-compromise/00/

CrowdStrike, “Indicators of Attack vs. Indicators of Compromise,” Apr. 29, 2021. [Online]. Available: https://www.crowdstrike.com/resources/white-papers/indicators-attack-vs-indicators-compromise/

M. F. Umer, M. Sher, and Y. Bi, “Flow-based intrusion detection: Techniques and challenges,” Compur. Secur., vol. 70, pp. 238-254, Sept. 2017, doi: 10.1016/j.cose.2017.05.009.

R. Chen, W. Niu, X. Zhang, Z. Zhuo, and F. Lv, “An Effective Conversation-Based Botnet Detection Method,” Math. Probl. Eng., vol. 2017, Art. ID 4934082, doi: 10.1155/2017/4934082.

T. Bakhshi and B. Ghita, “Traffic Profiling: Evaluating Stability in Multi-device User Environments,” in 2016 30th Int. Conf. Adv. Inf. Netw. Appl. Workshops (WAINA), 2016, pp. 731-736, doi: 10.1109/WAINA.2016.8.

C. F. T. Pontes, M. M. C. de Souza, J. J. C. Gondim, M. Bishop, and M. A. Marotta, “A New Method for Flow-Based Network Intrusion Detection Using the Inverse Potts Model,” IEEE Trans. Netw. Serv. Manag., vol. 18, no. 2, pp. 1125-1136, June 2021, doi: 10.1109/TNSM.2021.3075503.

B. Schmidt, A. Al-Fuqaha, A. Gupta, and D.-S. Kountanis, “Optimizing an artificial immune system algorithm in support of flow-Based internet traffic classification,” Appl. Soft Comput., vol. 54, pp. 1-22, May 2017, doi: 10.1016/j.asoc.2017.01.016.

Sun, J. Su, X. Wang, R. Chen, Y. Liu, and Q. Hu, “PriMal: Cloud-Based Privacy-Preserving Malware Detection,” in 22nd Australas. Conf. ACISP 2017, in Information Security and Privacy, J. Pieprzyk and S. Suriadi, Eds., in Lecture Notes in Computer Science, vol. 10343, 2017, doi: 10.1007/978-3-319-59870-3_9.

C. lan, J. Sherry, R. A. Popa, S. Ratnasamy, and Z. Liu, “Embark: Securely Outsourcing Middleboxes to the Cloud,” in 13th USENIX Symp. Netw. Syst. Des. Implement., USA, 2016, pp. 255-273.

M. Casenove, “Exfiltrations using polymorphic blending techniques: Analysis and countermeasures,” in 2015 7th Int. Conf. Cyber Confl. Archit. Cyberspace, Estonia, 2015, pp. 217-230, doi: 10.1109/CYCON.2015.7158479.

Priyanka and M. Dave, “PeerFox: Detecting parasite P2P botnets in their waiting stage,” in 2015 Int. Conf. Signal Proc. Comput. Control (ISPCC), India, 2015, pp. 350-355, doi: 10.1109/ISPCC.2015.7375054.

H. Asai, K. Fukuda, P. Abry, P. Borgnat, and H. Esaki, “Network application profiling with traffic causality graphs,” Int. J. Netw. Manag., vol. 24, no. 4, pp. 289-303, June 2014, doi: 10.1002/nem.1865.

P. Narang, C. Hota, and VN Venkatakrishnan, “PeerShark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification,” EURASIP J. Inf. Secur., vol. 2014, Oct. 2014, Art. no. 15, doi: 10.1186/s13635-014-0015-3.

M. Husák, G. Apruzzese, S. J. Yang, and G. Werner, “Towards an Efficient Detection of Pivoting Activity,” in 2021 IFIP/IEEE Int. Symp. Integr. Netw. Manag. (IM), France, 2021, pp. 980-985.

N. Haynes, Cyber Crime, UK: ED- Tech, 2020.

M. Chatel, “RFC 1919 Classical versus Transparent IP Proxies,” Mar. 1996. [Online]. Available: https://www.rfc-editor.org/info/rfc1919

P. B. Gentry, “What is a VPN?,” Inf. Secur. Tech. Rep., vol. 6, no. 1, pp. 15-22, Mar. 2001, doi: 10.1016/S1363-4127(01)00103-0.

Rapid7, “Setting up a test environment for VPN Pivoting with Metasploit Pro,” Jul. 26, 2017. [Online]. Available: https://www.rapid7.com/blog/post/2010/12/02/setting-up-a-test-environment-for-vpn-pivoting-with-metasploit-pro/ (Accessed Jul. 28, 2021)

R. Mudge, “How VPN Pivoting Works (with Source Code),” Oct. 14, 2014. [Online]. Available: https://www.cobaltstrike.com/blog/how-vpn-pivoting-works-with-source-code/ (Accessed Jul. 28, 2021)

A. Hammoudeh, “VPN Pivoting,” Feb. 11, 2013. [Online]. Available: https://resources.infosecinstitute.com/topic/vpn-pivoting/ (Accessed Jul. 28, 2021)

EOSec, “VPN Pivoting,” Jan. 6, 2013. [Online]. Available: http://gacksecurity.blogspot.com/2013/01/vpn-pivoting.html (Accessed Jul .28, 2021)

“sshuttle: where transparent proxy meets VPN meets ssh,”.[Online]. Available: https://github.com/sshuttle/sshuttle (Accessed Apr. 29, 2021)

J. Pillora, “Chisel,” [Online]. Available: https://github.com/jpillora/chisel (Accessed Aug. 05, 2021)

H. Zimmermann, “OSI Reference Model - The ISO Model of Architecture for Open Systems Interconnection,” IEEE Trans. Commun., vol. 28, no. 4, pp. 425-432, April 1980, doi: 10.1109/TCOM.1980.1094702.

K. Sahu, F. Alzahrani, R. K. Srivastava, and Rajeev Kumar, “Evaluating the Impact of Prediction Techniques: Software Reliability Perspective,” Comput. Mater. Continua, vol. 67, no. 2, pp. 1471-1488, 2021, doi: 10.32604/cmc.2021.014868.

A. Attaallah, H. Alsuhabi, S. Shukla, R. Kumar, B. Kumar Gupta, and R. Khan, “Analyzing the Big Data Security Through a Unified Decision-Making Approach,” Intrll. Autom. Soft. Comput., vol. 32, no. 2, pp. 1071-1088, 2022, doi: 10.32604/iasc.2022.022569.

E. Bocchi, et al., “MAGMA network behavior classifier for malware traffic,” Int. J. Comput. Telecommun. Netw., vol. 109, no. P2, pp. 142-156, Nov. 2016, doi: 10.1016/j.comnet.2016.03.021.

Y. Li, X. Wang, Z. Shi, R. Zhang, J. Xue, and Z. Wang, “Boosting training for PDF malware classifier via active learning,” Int. J. Intell. Syst., vol. 37, no. 4, pp. 2803-2821, May 2021, doi: 10.1002/int.22451.

W. Alabbas, H. M. al-Khateeb, A. Mansour, G. Epiphaniou and I. Frommholz, "Classification of colloquial Arabic tweets in real-time to detect high-risk floods," in 2017 Int. Conf. Soc. Media, Wearable Web Anal. (Soc. Media), 2017, pp. 1-8, doi: 10.1109/SOCIALMEDIA.2017.8057358.

T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction to Algorithms, 3rd Ed., Cambridge, MA, USA: MIT Press, 2009.

R. S. Marques, et al., “A Flow-based Multi-agent Data Exfiltration Detection Architecture for Ultra-low Latency Networks,” ACM Trans. Internet Technol., vol. 21, no. 4, pp. 1-30, Art. No. 103, 2021, doi: 10.1145/3419103.

إصدار

مجلد 5 عدد 2 (2022)

القسم

بحث أصلي

معلومات حقوق التأليف والنشر