Describing Advanced Persistent Threats Using a Multi-agent System Approach

Sravani Teja Bulusu (1) , Romain Laborde (1) , Ahmad Samer Wazan (1) , François Barrère (1) , Abdelmalek Benzekri (1, 2)

1 IRIT-SIERA - Service IntEgration and netwoRk Administration
2 UT3 - Université Toulouse III - Paul Sabatier

Advanced Persistent Threats are increasingly becoming one of the major concerns to many industries and organizations. Currently, there exists numerous articles and industrial reports describing various case studies of recent notable Advanced Persistent Threat attacks. However, these documents are expressed in natural language. This limits the efficient reusability of the threat intelligence information due to ambiguous nature of the natural language. In this article, we propose a model to formally represent Advanced Persistent Threats as multi-agent systems. Our model is inspired by the concepts of agent-oriented social modelling approaches, generally used for software security requirement analysis.

Mots clés: Attack trees; Advanced Persistent Threats; Multi-agentsystems

Domaines: Architectures Matérielles [cs.AR]; Systèmes embarqués; Système multi-agents [cs.MA]; Réseaux et télécommunications [cs.NI]; Système d'exploitation [cs.OS]

Sravani Teja Bulusu, Romain Laborde, Ahmad Samer Wazan, François Barrère, Abdelmalek Benzekri. Describing Advanced Persistent Threats Using a Multi-agent System Approach. Cyber Security in Networking Conference (CSNet), Oct 2017, Rio de Janeiro, Brazil. pp.0, ⟨10.1109/CSNET.2017.8241997⟩. ⟨hal-02863299⟩