Search papers, labs, and topics across Lattice.
This paper introduces ADAPTD, a decision-theoretic framework designed to enhance detection and defense against advanced persistent threats (APTs) in segmented enterprise networks. By integrating compact kill chains, an immediate blocking mechanism, and a predictive eviction strategy, ADAPTD effectively balances the need for situational awareness with the overhead of communication and computation. Experimental results demonstrate that ADAPTD outperforms existing methods in reducing false evictions and maintaining system security, particularly in noisy environments.
ADAPTD reduces false evictions while effectively containing attackers, proving that efficient threat defense can be achieved without sacrificing system performance.
Advanced persistent threat (APT) actors increasingly employ sophisticated techniques to propagate laterally through segmented enterprise networks. Timely detection and defense depend on cross-subnetwork coordination, yet maintaining global situational awareness generates substantial communication overhead. To manage this tradeoff, flexible monitoring and adaptable containment are imperative. This paper presents ADAPTD, a communication- and computation-efficient, decision-theoretic framework integrating: (i) compact kill chains for identifying diverse attack vectors, (ii) an immediate blocking mechanism for timely containment, and (iii) a predictive eviction strategy to restore system security. Our experiments validate ADAPTD's effectiveness across diverse threat scenarios. First, our decentralized belief update scheme outperforms state-of-the-art diffusion HMM. Second, ADAPTD substantially reduces false evictions compared to transformer-based detection. Third, under noisy environments, adaptive blocking contains attackers while minimizing unnecessary disruption. Lastly, the ablation study confirms that combining two defensive actions significantly reduces the defender's total cost.
