Detection: Definition of new model to reveal advanced persistent threat

Abstract

Today we live in the age of cyberwar. Cyberwarfare is Internet-based conflict involving politically motivated attacks on information and information systems. Cyberwarfare attacks can disable official websites and networks, disrupt, or disable essential services, steal or alter classified data, and cripple financial systems among many other possibilities. The number and complexity of these cyber-attacks has been increasing steadily. The commonly name used for these attacks is APT (Advanced Persistent Threat). APT commonly target the communication and information systems of government, military, and industrial organizations; a clear indication of the level of sophistication of APT is their impressive arsenal. Advances in attacker sophistication have not been matched by similar defensive one. To defend against such sophisticated adversaries, it is necessary to redesign our defenses and develop technologies focused more on detection than prevention. In recent years, the massive use of the mobile devices has shifted the focus of the attackers on the mobile world. Increasingly, these devices are used in the enterprise and government world. Obviously, the purpose is to detect the presence of APT in the mobile field. The purpose of this paper is to implement a new and unconventional method to detect APT based on detection and not on prevention.