Technical Summary: Cyber Persistence Detector (CPD)

Problem Statement

Advanced Persistent Threat (APT) attackers increasingly rely on cyber persistence techniques to maintain long-term access to victim systems, often evading detection by employing "low and slow" strategies that fragment attack phases over time. While Provenance-based Intrusion Detection Systems (PIDS) and rule-based detection systems (e.g., Elastic, Sigma) exist, they face significant limitations in detecting these threats:

• Rule-based systems often trigger high false positive rates (FPs) by flagging benign system functionality (e.g., Registry run keys) without assessing the broader context or subsequent malicious execution. Conversely, overly relaxed rules to reduce FPs lead to high false negatives (FNs).
• Existing PIDS (both learning-based and heuristic-based) struggle to connect disjointed attack phases. They often fail to link the initial "persistence setup" (e.g., creating a scheduled task) with the subsequent "persistence execution" (e.g., a remote connection initiated by that task), especially when these events are separated by system reboots or time delays. This results in fragmented, low-severity attack graphs that are often deprioritized or missed entirely.
• Data Gaps: Standard logging frameworks often miss inter-process communication (IPC) events (e.g., Windows ALPC), creating gaps in provenance graphs that prevent linking the attacker's initial actions to the system processes they manipulate.

Methodology

The authors propose the Cyber Persistence Detector (CPD), a system designed to detect persistence threats by causally relating the "persistence setup" and "persistence execution" phases. CPD operates on the insight that effective persistence attacks consist of two distinct but linked phases: a setup phase that modifies system state, and an execution phase that utilizes that state to establish remote access.

The system employs a four-step pipeline:

1. Persistence Setup Detection: CPD processes system audit logs to identify activities matching specific detection rules derived from MITRE ATT&CK (e.g., modifications to Registry run keys, scheduled tasks, or service configurations). These events are recorded in a Persistence Setup Table.
2. Persistence Execution Detection: The system identifies processes initiating or accepting remote connections. It performs backward tracing on these processes to generate sub-graphs and checks them against Persistence Execution Detection Rules (e.g., specific system processes like explorer.exe or services.exe reading the modified keys). Matches are recorded in a Persistence Execution Table.
3. Pseudo-Dependency Edge (Pseudo-edge) Creation: CPD aligns entries from the Setup and Execution tables based on TTP (Tactics, Techniques, and Procedures) labels, temporal order, and specific attributes. When an alignment is found, it creates a pseudo-edge to causally link the disjoint setup and execution atomic graphs. This creates a comprehensive, succinct attack graph that spans potential reboot boundaries.
4. False Positive Reduction & Alert Triage: To address the high volume of benign activities that mimic persistence (e.g., legitimate update services), CPD introduces a False Positive Reduction Algorithm. This algorithm calculates an anomaly/threat score for each pseudo-edge based on:
   • Causality-based indicators: Degree of indirection in process chains, presence of credential access tactics, and the execution of multiple persistence techniques in concert.
   • Correlation-based indicators: Contextual factors such as the legitimacy of the accessing computer's domain account, local account creation after lateral movement, and the use of remote access tools.
   • Scoring: The algorithm assigns weights to indicators and ranks pseudo-edges. Only those exceeding a specific threat score threshold (or within an analyst's "alert budget") are flagged as true positives.

Key Technical Innovations

• Pseudo-edges: These virtual edges bridge the temporal and logical gaps between setup and execution phases, enabling the reconstruction of complete attack narratives even when events are separated by reboots or time.
• Expert-Guided Edges: To mitigate the need for massive volumes of IPC logs (like Windows ALPC) which are often missing or too large to store, CPD uses expert knowledge of OS policies (e.g., linking sc.exe to services.exe based on service name and timing) to infer missing dependencies. This reduces log storage requirements by an average of 37%.
• Contextual Triage: Unlike systems that rely solely on static signatures, CPD evaluates the consequences of system functionality usage, distinguishing between benign usage and malicious exploitation by analyzing the broader kill-chain context.

Key Contributions

1. Novel Detection System: Introduction of CPD, the first detection system specifically targeting persistence threats using provenance analytics to link setup and execution phases.
2. Pseudo-Dependency Edges: A mechanism to causally relate disjoint persistence phases, improving the detection of stealthy, multi-stage attacks.
3. Expert-Guided Edges: A technique to refine provenance graphs and reduce log volume by inferring missing IPC links based on OS policies, avoiding the need for exhaustive logging.
4. Alert Triage Algorithm: A novel algorithm that reduces false positives by analyzing the proximity of related kill-chain techniques and tactics within the provenance graph.
5. Comprehensive Evaluation: Implementation and testing on diverse datasets, including public datasets (DARPA E5, OpTC) and datasets derived from strict MITRE ATT&CK emulation plans (APT29, Sandworm).

Results

Evaluations conducted on public and MITRE-emulated datasets demonstrate the following:

• False Positive Reduction: CPD reduces the average false positive rate by 93% compared to state-of-the-art open-source SIEM rules (Elastic, Sigma, Chronicle) and commercial EDR systems (VMware CBC).
• Accuracy: The system successfully detects true persistence attacks that other systems miss, particularly those involving fragmented phases or reboot-based persistence.
• Log Reduction: The use of expert-guided edges reduces log storage requirements by an average of 37% (up to 53% in specific scenarios) by eliminating the need for full ALPC logging.
• Performance: CPD achieves a response time of under one minute for its entire pipeline. In comparisons with learning-based PIDS (KAIROS, FLASH), CPD is significantly faster (315x faster than KAIROS, 156x faster than FLASH) and consumes less memory (4x less), while maintaining higher accuracy in detecting persistence.
• Graph Quality: The system generates succinct, explainable attack graphs that clearly distinguish between setup and execution, aiding security analysts in rapid incident response.

Significance and Claims

The paper claims that CPD addresses a critical gap in APT defense by shifting the focus from isolated detection of system functionality misuse to the causal relationship between setup and execution. The authors assert that:

• Persistence is often misunderstood in academic research and detection systems, which fail to recognize the two-phase nature of these attacks.
• By avoiding optimistic assumptions about persistence behavior and the need for training data, CPD offers a reliable, explainable, and transferable solution.
• The system satisfies five key properties for effective threat detection: reliability, explainability, analytical depth, contextuality, and transferability.
• CPD is designed to be practical for enterprise settings, capable of reducing alert fatigue while ensuring that genuine persistence threats are prioritized for investigation.

The authors emphasize that while the system relies on the MITRE ATT&CK framework, its underlying principles (segmentation into setup/execution and causal linking) are generalizable, making it adaptable to emerging threats without requiring frequent, complex retraining.