Abstract:

In recent years, with the development of automatic extraction technology of open source threat intelligence, threat hunting on Provenance Graph driven by threat intelligence has the advantages of not requiring expert knowledge and providing complete attack scenarios, which is an effective threat detection method. However, existing threat hunting methods still suffer from several limitations. On the one hand, they rely on Indicators of Compromise (IOC) for threat searches, which makes them difficult to effectively detect threats in cases where the attack evades detection; on the other hand, existing methods often neglect the application scenarios of continuous hunting, ignoring the high costs associated with such hunting. To address these issues, this paper proposed a Threat Intelligence-Driven Dynamic Threat Hunting Method (DyHunter), which can perform continuous threat hunting even when threat intelligence is inconsistent with the actual attack due to attack evasion. DyHunter used a composite candidate subgraph selection algorithm to avoid missing attack nodes and attack subgraphs, and employed a multi-layer graph similarity learning method to learn topology and node attribute similarity to improve model robustness. It generated and maintained a suspicious subgraph to reduce the cost of continuous hunting. Experimental results show that, compared with existing methods, DyHunter can effectively ensure high accuracy under the impact of attack evasion, and reduce more than 94.1% of space overhead during the continuous hunting process.

Key words: threat intelligence, provenance graph, threat hunting, graph similarity learning