HeATed Alert Triage (HeAT): Transferrable Learning to Extract Multistage Attack Campaigns

TL;DR

HeAT (Heated Alert Triage) is a transfer learning approach that extracts multistage attack campaigns from critical security alerts, aiding analysts in understanding complex cyber attack sequences across different networks.

Contribution

This work introduces HeAT, a transferable, network-agnostic model that captures analyst assessments of attack campaign heat and applies it to unseen IoCs for improved cyber threat analysis.

Findings

Successfully extracted multistage attack campaigns from alerts.

Reduced irrelevant alerts significantly.

Aligned well with analyst assessments.

Abstract

With growing sophistication and volume of cyber attacks combined with complex network structures, it is becoming extremely difficult for security analysts to corroborate evidences to identify multistage campaigns on their network. This work develops HeAT (Heated Alert Triage): given a critical indicator of compromise (IoC), e.g., a severe IDS alert, HeAT produces a HeATed Attack Campaign (HAC) depicting the multistage activities that led up to the critical event. We define the concept of "Alert Episode Heat" to represent the analysts opinion of how much an event contributes to the attack campaign of the critical IoC given their knowledge of the network and security expertise. Leveraging a network-agnostic feature set, HeAT learns the essence of analyst's assessment of "HeAT" for a small set of IoC's, and applies the learned model to extract insightful attack campaigns for IoC's not seen before, even across networks by transferring what have been learned. We demonstrate the capabilities of HeAT with data collected in Collegiate Penetration Testing Competition (CPTC) and through collaboration with a real-world SOC. We developed HeAT-Gain metrics to demonstrate how analysts may assess and benefit from the extracted attack campaigns in comparison to common practices where IP addresses are used to corroborate evidences. Our results demonstrates the practical uses of HeAT by finding campaigns that span across diverse attack stages, remove a significant volume of irrelevant alerts, and achieve coherency to the analyst's original assessments.