Big Data Analytics for Sophisticated Attack Detection

The number and complexity of cyberattacks has been increasing steadily in recent years. The major players in today’s cyberconflicts are well organized and heavily funded teams with specific goals and objectives, some of which are working under a state umbrella. Adversaries are targeting the communication and information systems of government, military and industrial organizations and are willing to use large amounts of money, time and expertise to reach their goals. It is important to understand the problems and limitations that current technologies face against advanced persistent threats (APTs)1 and the benefits that big data analytics could provide. Since 2006, there have been a large number of advanced, well-orchestrated attacks against industry, military and state infrastructures. In 2007, Estonia suffered a large-scale cyberattack that significantly affected the government’s online services and financial institutions.2 In 2008, at least three US oil companies were targets of cyberattacks; none of these companies realized the extent of the attacks until they were alerted by the US Federal Bureau of Investigation (FBI).3 Millions of pounds sterling were stolen from British shoppers as multiple chip and pin machines were tampered with via a supply chain attack.4 In 2010, Google announced that it had suffered a sophisticated attack, named Operation Aurora. This attack affected more than 20 US companies. In the same year, Stuxnet5, 6 was detected and classified as the “world’s most advanced malware.” It was created to target industrial control systems including oil, gas and power industries. In 2011, RSA7 was attacked and sensitive information for the company’s SecurID solution was stolen. This has resulted in further attacks against third-party companies, including Lockheed Martin and other US defense contractors that were also using RSA security solutions. Comodo and DigiNotar certification authorities were also subject to attacks, resulting in the generation of several fraudulent certificates for major companies and organizations.8 In 2012, another state-of-theart malware named Flame was discovered, which malware researchers noted as the most complex malware ever created,9, 10 followed by Red October and, in early 2013, Mini Duke.11 While it is believed that these attacks were perpetrated by different threat actors, they share certain common aspects and some of them have been categorized as APTs.