A Behavioral Study of Advanced Security Attacks in Enterprise Networks

Securing enterprise networks from cyber attacks has become one of the most paramount and daunting tasks for any organization or industry in recent times. Traditional cyber-attacks that use spam, adware or ransomware mostly target individual users with the purpose of making profit. On the other hand, advanced security attacks, also known as Advanced Persistent threats (APTs) are highly customized and sophisticated attacks which are carefully designed to target a specific company or organization. These attacks are more difficult to prevent, detect and mitigate since they are designed to evade the security measures available in the targeted organization. Such attacks not only involve a variety of tools but also employ a variety of tactics and techniques. This paper is an effort to study the various characteristics of APTs and categorize attack indicators into relevant groups for the purpose of comparison and evaluation. Finally, we summarize the effectiveness of employing these behavioral indicators in the detection of an on-going APT attack in an enterprise network.