SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
summary
SLEUTH builds a platform-neutral, main-memory dependency graph from Linux, Windows and FreeBSD COTS audit sources and applies tag-based detection (separate code/data trust tags) to spot suspicious modification, untrusted execution and data exfiltration. It reconstructs scenarios with backward/forward shortest-path analysis, produces compact visual graphs from millions of events, and in DARPA red-team runs achieves roughly a 50,000× reduction in noise, finding 174 of 175 ground-truth points with low false positives.
AI-written summary · about
chapters (5)
- 0:00The challenge of APTs
- 3:48Sleuth system architecture
- 6:58Illustrative attack scenario
- 11:17Tag-based attack detection
- 20:33Graph analysis and results
related talks
20mSLEIGHT: Real-time Closed-Loop Attack Analytics Framework for Holistic Intrusion...
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations
27mBreach - ATT&CK - Osquery
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
36mBeing A Better Defender By Channeling Your Worst Adversary:
40mFantastic Red-Team Attacks and How to Find Them
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
15mThreat Analysis and Detection in In-Vehicle Infotainment System Leveraging MITRE...