SAGA: Synthetic Audit Log Generation for APT Campaigns
Yi-Ting Huang, Ying-Ren Guo, Yu-Sheng Yang, Guo-Wei Wong, Yu-Zih Jheng, Yeali Sun, Jessemyn Modini, Timothy Lynar, Meng Chang Chen

TL;DR
SAGA is a novel method for generating realistic, labeled synthetic audit logs that simulate APT campaigns, aiding in training and evaluating detection systems for sophisticated cyber threats.
Contribution
This paper introduces SAGA, a configurable system for creating synthetic audit logs that embed APT attack techniques, filling a gap in datasets for cybersecurity research.
Findings
Synthetic logs effectively mimic real-world APT campaigns.
Deep learning models trained on synthetic logs detect unseen attack techniques.
Synthetic logs serve as valuable benchmarks for APT detection methods.
Abstract
With the increasing sophistication of Advanced Persistent Threats (APTs), the demand for effective detection and mitigation strategies and methods has escalated. Program execution leaves traces in the system audit log, which can be analyzed to detect malicious activities. However, collecting and analyzing large volumes of audit logs over extended periods is challenging, further compounded by insufficient labeling that hinders their usability. Addressing these challenges, this paper introduces SAGA (Synthetic Audit log Generation for APT campaigns), a novel approach for generating find-grained labeled synthetic audit logs that mimic real-world system logs while embedding stealthy APT attacks. SAGA generates configurable audit logs for arbitrary duration, blending benign logs from normal operations with malicious logs based on the definitions the MITRE ATT\&CK framework. Malicious audit…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPeer-to-Peer Network Technologies · Internet Traffic Analysis and Secure E-voting · Recommender Systems and Techniques
