Cyber attacks are often identified using system and network logs. There have been significant prior works that utilize provenance graphs and ML techniques to detect attacks, specifically advanced persistent threats, which are very difficult to detect. Lately, there have been studies where transformer-based language models are being used to detect various types of attacks from system logs. However, no such attempts have been made in the case of APTs. In addition, existing state-of-the-art techniques that use system provenance graphs, lack a data processing framework generalized across datasets for optimal performance. For mitigating this limitation as well as exploring the effectiveness of transformer-based language models, this paper proposes LogShield, a framework designed to detect APT attack patterns leveraging the power of self-attention in transformers. We incorporate customized embedding layers to effectively capture the context of event sequences derived from provenance graphs. While acknowledging the computational overhead associated with training transformer networks, our framework surpasses existing LSTM and Language models regarding APT detection. We integrated the model parameters and training procedure from the RoBERTa model and conducted extensive experiments on well-known APT datasets (DARPA OpTC and DARPA TC E3). Our framework achieved superior F1 scores of 98% and 95% on the two datasets respectively, surpassing the F1 scores of 96% and 94% obtained by LSTM models. Our findings suggest that LogShield's performance benefits from larger datasets and demonstrates its potential for generalization across diverse domains. These findings contribute to the advancement of APT attack detection methods and underscore the significance of transformer-based architectures in addressing security challenges in computer systems.

翻译：网络攻击通常通过系统和网络日志进行识别。已有大量前期工作利用溯源图和机器学习技术检测攻击，特别是极难检测的高级持续性威胁（APT）。近期，有研究开始使用基于Transformer的语言模型从系统日志中检测多种类型的攻击，但尚未有类似尝试应用于APT场景。此外，现有最先进的系统溯源图技术缺乏跨数据集通用化的数据处理框架以实现最优性能。为弥补这一局限性并探索基于Transformer的语言模型的有效性，本文提出LogShield——一个利用Transformer自注意力机制检测APT攻击模式的框架。我们设计了定制化的嵌入层以有效捕捉源自溯源图的事件序列上下文信息。尽管承认训练Transformer网络会带来计算开销，但本框架在APT检测性能上超越了现有的LSTM和语言模型。我们整合了RoBERTa模型的参数与训练流程，并在知名APT数据集（DARPA OpTC和DARPA TC E3）上开展了广泛实验。本框架在两个数据集上分别取得了98%和95%的优异F1分数，超越了LSTM模型取得的96%和94%的F1分数。研究结果表明，LogShield的性能随着数据集规模增大而提升，并展现出跨不同领域的泛化潜力。这些发现推动了APT攻击检测方法的发展，并凸显了基于Transformer的架构在应对计算机系统安全挑战中的重要性。