@inproceedings{0eadd4c6f8984c449208081f278edd77,
title = "N-victims: An approach to determine N-victims for APT investigations",
abstract = "The advanced Persistent Threat (APT) is a sophisticated and target-oriented cyber attack for accessing valuable information. The attacker leverages the customized malware as the stepping stone to intrude into the enterprise network. For enterprises and forensic analysts, finding the victims and investigating them to evaluate the damages are critical, but the investigation is often limited by resources and time. In this paper, we propose an N-Victims approach that starts from a known malware-infected computer to determine the top N most likely victims. We test our approach in a real APT case that happened in a large enterprise network consisting of several thousand computers, which run a commercial antivirus system. N-Victims can find more malware-infected computers than N-Gram based approaches. In the top 20 detected computers, N-Victims also had a higher detection rate and a lower false positive rate than N-Gram based approaches.",
keywords = "Advanced persistent threat, Botnet detection, Incident investigation, Malware detection",
author = "Liu, {Shun Te} and Chen, {Yi Ming} and Hung, {Hui Ching}",
note = "Publisher Copyright: {\textcopyright} Springer-Verlag Berlin Heidelberg 2012.; 13th International Workshop on Information Security Applications, WISA 2012 ; Conference date: 16-08-2012 Through 18-08-2012",
year = "2012",
doi = "10.1007/978-3-642-35416-8_16",
language = "???core.languages.en_GB???",
isbn = "9783642354151",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "226--240",
editor = "Lee, {Dong Hoon} and Moti Yung",
booktitle = "Information Security Applications - 13th International Workshop, WISA 2012, Revised Selected Papers",
}