EAGLE Cyber Forensics: Efficient and Automated Cyber Forensics with Graph Learning at Standalone Endpoints

To fight against Advanced Persistent Threats (APTs) and other stealthy multi-stage attacks, data provenance analysis on provenance graphs has emerged as one of most effective methods. Existing learning-based provenance analysis solutions differ in terms of the granularity of target, embeddings, learning modes, attack knowledge, incrementally performing capability, and the report granularity of the detection. However, none of them are effective and practical enough to address the needs in the connectivity-disadvantaged tactical environments in which each endpoint has no backhaul connectivity, no onboard operator expertise, and limited computation and storage capabilities. To address this need, P&J Robinson Corporation (PJR) along with its university partner, propose to develop EAGLE Cyber Forensics, an Efficient and Accurate Cyber Forensics with Graph Learning at Standalone Endpoints that can operate at a standalone endpoint without the backhaul connectivity. EAGLE Cyber Forensics (EAGLE CyFor) will distill the rich, onboard system and network activities data, to identify suspicious behaviors, map them to possible attack tactics, techniques, and procedures (TTPs), and facilitate to reconstruct the attack story or match them to the potential/similar kill chain.