A Query System for Efficiently Investigating Complex Attack Behaviors for Enterprise Security
Peng Gao, Xusheng Xiao, Zhichun Li, Kangkook Jee, Fengyuan Xu, Sanjeev, R. Kulkarni, Prateek Mittal

TL;DR
AIQL is a specialized query system designed for efficient investigation of complex attack behaviors in enterprise security, featuring a domain-specific language, optimized execution, and deployment in real-world environments.
Contribution
The paper introduces AIQL, a novel domain-specific query system with optimized execution tailored for attack investigation in enterprise security environments.
Findings
Successfully deployed AIQL on 150 hosts in NEC Labs.
Demonstrated AIQL's effectiveness in investigating APT attacks.
Enabled interactive attack investigation through a web UI.
Abstract
The need for countering Advanced Persistent Threat (APT) attacks has led to the solutions that ubiquitously monitor system activities in each enterprise host, and perform timely attack investigation over the monitoring data for uncovering the attack sequence. However, existing general-purpose query systems lack explicit language constructs for expressing key properties of major attack behaviors, and their semantics-agnostic design often produces inefficient execution plans for queries. To address these limitations, we build AIQL, a novel query system that is designed with novel types of domain-specific optimizations to enable efficient attack investigation. AIQL provides (1) domain-specific data model and storage for storing the massive system monitoring data, (2) a domain-specific query language, Attack Investigation Query Language (AIQL) that integrates critical primitives for…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Software System Performance and Reliability
