Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures

2025-02-12

AI Summary

Advanced Persistent Threat (APT) groups employ highly evasive covert communication channels during prolonged stealthy operations, rendering traditional network intrusion detection systems (NIDS) ineffective—particularly against DNS- and HTTP(S)-based command-and-control (C&C) traffic. Method: This paper systematically analyzes the evolution of Tactics, Techniques, and Procedures (TTPs) across 33 APT groups over 22 years, focusing on DNS and HTTP(S) protocol layers. It introduces the first quantitative framework revealing synergistic obfuscation mechanisms—spanning dynamic DNS, typosquatting, TLD hijacking, and HTTPS-based evasion (covering 81% of observed samples)—by integrating TTP-labeled attribution, protocol behavioral modeling, domain lifecycle tracking, and HTTPS semantic parsing. Contribution/Results: The work identifies and classifies 12 high-stealth network TTPs, empirically confirms C&C’s critical dependence on DNS, and delivers a deployable, semantics-aware detection rule set alongside a standardized evaluation benchmark for context-aware NIDS.

Technology Category

• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Game Theory and Economic Paradigms: Cooperative Game Theory
• Multiagent Systems: Agent Communication

Application Category

• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Web Mining and Content Analysis: Models for Web evolution
• Security and Privacy: Large-scale security measurements

Abstract

The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques. To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to take into account the specific context of the attack explained in this paper. In this study, we select 33 APT campaigns based on the fair distribution over the past 22 years to observe the evolution of APTs over time. We focus on their evasion techniques and how they stay undetected for months or years. We found that APTs cannot continue their operations without C&C servers, which are mostly addressed by Domain Name System (DNS). We identify several TTPs used for DNS, such as Dynamic DNS, typosquatting, and TLD squatting. The next step for APT operators is to start communicating with a victim. We found that the most popular protocol to deploy evasion techniques is using HTTP(S) with 81% of APT campaigns. HTTP(S) can evade firewall filtering and pose as legitimate web-based traffic. DNS protocol is also widely used by 45% of APTs for DNS resolution and tunneling. We identify and analyze the TTPs associated with using HTTP(S) based on real artifacts.

Problem

• Analyze APT TTPs for detection strategies
• Study APT evasion techniques evolution
• Identify DNS and HTTP(S) APT tactics

Innovation

• Analyzes APT evasion techniques evolution
• Focuses on DNS and HTTP(S) protocols
• Identifies TTPs for network intrusion detection