RNN-based Deep Learning scheme for predicting multi-stage security events

In recent years adversaries have dramatically evolved their attacking capability. Indeed, adversaries are capable of commiting cyber attacks with unprecedented sophistication. They intrude on computing systems through multiple steps of heterogeneous nature to reach their targets aiming to either remotely take advantage of the compromised device, or use encryption techniques (i.e. ransomware attacks) to prevent their victims from accessing their personal files and hold data hostage. These multi-stage compound attacks derive from diverse malicious behavior, such as (i) sending spearphishing emails of malicious attachments, (ii) performimg drive-by download attacks that can exploit vulnerabilities in Web browsers and (iii) conducting privilege escalation exploits.

Traditionally, security specialists have utilized a variety of statistical methods to respond. Lately, the cybersecurity community has focused on predicting malevolent activity that can cause unwanted security events, such as a data breach, malware infection, vulnerability exploitation in the wild and even a possible future website attack. These type of predictions take into account the historical data from previous events.

Nevertheless, existing prediction techniques are facing some major limitations:

• most of them provide binary analysis prediction without capturing insights on the adversary’s attacking behaviour and without studying the attackers’ modus operandi,
• most of these techniques rely on labeled data which cannot be sufficiently provided in all occasions
• given that adversaries change their modus operandi frequently both binary detection and feature engineering approaches require regular updates and retrains to continue bringing accurate results.

As a result, there is an inherent security gap in finding solutions that do not only detect malicious events, but also look into the specific steps an adversary would follow to realize an attack. Deep Learning architectures, such as Recurrent Neural Networks (RNNs) can be a good choice to adopt in time-series prediction techniques as they provide a thorough analysis on the subsequent steps of a potential complex, multi-stage attack considering previous steps output to estimate the following step.

Yun Shen, Enrico Mariconti, Pierre-Antoine Vervier and Gianluca Stringhini in their research work "Tiresias: Predicting Security Events Through Deep Learning" propose the Tiresias system which leverages Recurrent Neural Networks (RNNs) to predict future events on a machine, focused on previous observations.

As long-term memory is typical of RNNs, it can be a key to perform event prediction and provide the accurate actions an adversary would undertake to perform a compound cyber attack. To develop the Tiresias system, they leverage recent advances in the area of deep learning and produced a system that learns from past system events to specifically predict the next trigger event. Tiresias can provide precise predictive information encouraging companies to deploy truly proactive countermeasures according to the predicted information (i.e. estimate the potential severity of an attack by observing its early steps). Tiresias operations workflow falls into four phases: (i) data collection and preprocessing, (ii) model training & validation, (iii) security event prediction, and (iv) prediction performance monitoring. The proposed solution can apply in complex multi-step attack environments and address the noise generated by legitimate or non-related malicious events in the wild. The authors show that the Tiresias system can clearly outperform simpler systems that are only based on short-term memory (e.g., Markov Chains). In particular, the Tiresias system has been evaluated on a dataset of 3.4 billion security events collected from a commercial intrusion prevention system. The findings proved the effectiveness of the approach in predicting the next event that will occur on a machine with a hich precision up to 0.93. Furthermore, it was shown that models learned by Tiresias are reasonably stable over time and they are capable of detecting sudden drops in accuracy and triggering a system retrain model wherever whether predictions precision drops below a certain threshold. In addition, the Tiresias architecture is reasonably flexible in terms of real-world deployment.

However, the proposed solution embeds some limitations. For instace, the Tiresias system could not operate efficiently for rare events that lack of training samples since the model is based on the availability of training data. Existing machine learning and statistical methods cannot yet overcome this challenge. Considering that deep learning systems while classifying samples are synchronously adopting rules, Tiresias system can be subject to evasion techniques from adversaries. In this vein, the malicious agent could influence the decision rules of the victim using fake actions before committing the attack. Nevertheless, to meet such issue the adversary must perform such fake actions in an extended scale targeting thousands of machines. A valuable future work to resolve this issue would be to discover methods that are able to quantify the amount of events necessary to evade systems as Tiresias.