A5060735807- Advanced Malware Detection Techniques
- Network Security and Intrusion Detection
- Information and Cyber Security
- Scientific Computing and Data Management
- Semantic Web and Ontologies
- Distributed and Parallel Computing Systems
- Anomaly Detection Techniques and Applications
- Cybercrime and Law Enforcement Studies
- Terrorism, Counterterrorism, and Political Violence
- Security and Verification in Computing
Zhejiang University of Technology
2023-2025
Advanced Persistent Threat (APT) attacks have caused massive financial loss worldwide. Researchers thereby proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed accurately effectively defend against the current that exhibit strong persistent, stealthy, diverse dynamic characteristics due weak data source integrity, large processing...
As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify series actions undertaken achieve attacker's target, called attack investigation. Currently, analysts construct provenance graph perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related attack). However, due vast size rarity events, existing investigation methods suffer from problems high false positives, overhead, latency. To...
Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false positives. In order not affect normal operations, analysts need investigate filter detection results before taking countermeasures, in which heavy manual labor alarm fatigue cause miss optimal response time, thereby leading information leakage destruction....
Cyber Threat Intelligence (CTI) reports are factual records compiled by security analysts through their observations of threat events or own practical experience with attacks. In order to utilize CTI for attack detection, existing methods have attempted map the content onto system-level provenance graphs clearly depict procedures. However, studies on constructing from suffer problems such as weak natural language processing (NLP) capabilities, discrete and fragmented graphs, insufficient...