Advanced Threat Detection: Stopping Advanced Attacks in their Tracks

Advanced Threat Detection: Stopping Advanced Attacks in their Tracks

Advanced threat detection monitors your infrastructure for advanced protection against attacks that bypass traditional security like firewalls, antivirus, and intrusion prevention. Advanced threat detection solutions and practices employ dynamic and proactive defense and protection techniques like sandboxing and user and entity behavior analytics (UEBA). The goal is to proactively detect, isolate, and mitigate, before an advanced attack escalates to a breach.

What Is Advanced Threat Detection?

Advanced threat detection is a set of practices and tools you can use to detect attacks that bypass traditional security measures. More companies are moving to the cloud and the amount of data that is collected and stored by companies is increasing. This has driven cybercriminals to come up with creative new ways of attacking systems.

Many of these attacks are not detected by traditional tools, such as firewalls, antivirus, or intrusion prevention systems. However, advanced threat detection solutions can help catch these attacks by using more dynamic methods. For example, behavioral analysis, sandboxing, or automated monitoring.

How Advanced Threat Detection Works

The basis of many advanced threat detection solutions is sandboxing. Sandboxing is a practice that isolates suspicious files. This isolation enables security analysts or tools to evaluate those programs without risk to the wider system. Solutions and analysts can then determine if a program or file is malicious based on its behavior.

This method is more reliable than signature-based matching, which requires that malware be known to the system or analyst. In contrast, advanced threat detection solutions can identify threats that are new or dynamic.

Another method that advanced threat detection tools use is behavioral analysis of network traffic. These solutions compare network behavior to an accepted baseline and alert security teams when behavior falls outside expected parameters. This identification can be used to sandbox files or block traffic.

What Are Attackers After?

When advanced attackers strike, they typically have one or more of the following goals:

• User credentials—enable attackers to enter systems without having to break-in. Instead, attackers can just use stolen user credentials to access resources easily, hiding as a legitimate user. Once inside a system, criminals often try to escalate the privileges of the user they’ve stolen credentials from or to create a new user entirely.
• Personally identifiable information (PII)—information like financial details, ID numbers, or birth dates, is valuable to criminals. They may steal personally identifiable information to sell to others or use it for other crimes, such as identity theft or blackmail.
• Intellectual property or sensitive information—this information is valuable to competitors and enemy nation-states. Criminals may attempt to steal this information to sell to others or to use for personal gain. Employee theft of this data is a significant risk since employees are already inside your systems and are more familiar with where this data may be stored.
• Revenge—this is typically done by angry users, ex-employees, or ‘hacktivists’ that want to punish or shame a company. These attackers may take down services, deface sites, or harass other users in an attempt to harm their target.

Attacks typically target data, but certain types of data are protected by compliance regulation entities, like HIPAA and GDPR. It’s important to make this distinction between data privacy and data protection. The two may sound similar but are not alike. There are certain qualifications you need to achieve, to be considered compliant, and each regulator has its own criteria.

Advanced Threat Detection Strategies

When trying to protect your systems from advanced threats, there are several strategies you can use. Applying multiple strategies provides better protection and can help you detect threats faster and more reliably.

Create a broad test repository

Part of advanced threat detection is based on the ability to compare potential threats against suspicious behavior. The more reliable and representative your behavioral repository is, the more reliable your detection results, and the fewer malware instances that are missed.

To ensure that your test baselines are robust, include data from both known threats and benign activity. When analyzing events, your solutions should test against malware variants, network traffic profiles, forensic data collected from your own systems, and dynamic behaviors.

In particular, you should be testing for multi-phase dropper malware behaviors. This type of malware plants multiple other malware files in your system, spreading the infection to avoid detection. Including examples of this kind of malware in your test repository can help prevent you from creating an overly simplified model of malware.

You can learn more about advanced threat protection in our guides:

• Malware Prevention: A Multi-Layered Approach
• Zero-Day Attack Prevention: 4 Ways to Prepare
• Social Engineering Prevention

Include benign software behavior

Creating a robust behavioral database also involves understanding how benign software behaves. When you know what processes normal programs run and how those programs interact with your system, you can better detect malware. You can also more reliably exclude false positives.

There are two ways that the behavior of benign software is collected — automation and live recording. The automation method involves downloading many applications to a sandbox and recording API calls, network activity, and forensic data. The download, installation, and run processes are all automated and the recorded data is added to a live sample database.

The second method involves recording live data from a production system. Rather than automating a separate process, you simply record the normal download and execution behavior that your users create. The downside of this option is that you must deploy recording software to your production systems and you may see a performance impact.

Continuous data collection and analysis

As previously stated, the more data you collect, the more effective your solution will be. By ensuring continuous data collection and analysis, you ensure that no events slip by your systems, limiting the chance that malware is overlooked.

To handle the volume of data that continuous monitoring and analysis create, you need to use a big data solution. This solution should be able to ingest data in real-time, transform data for analysis, analyze data, and feed analyses back to your monitoring and alerting solution.