Blockchain Capabilities in Defending Advanced Persistent Threats Using Correlation Technique and Hidden Markov Models (HMM)

Ulghar, I.; Jahankhani, H.; Kendzierskyj, S.

In December 2019, the world witnessed the start of a pandemic outbreak (Coronavirus or COVID-19) in Wuhan the capital of China’s Hubei province and from there quickly spread globally. The uncertainty and fear change represented a golden opportunity for threat actors. Early 2020 research discovered widespread evidence that threat actors embraced the COVID-19 fear event to mount Advanced Persistent Threats (APT) attacks and exploit the opportunity exposed by the disruption. Tactics ranging from phishing emails and social engineering to malware distribution have been identified with many malicious domains with medical information that delivered sophisticated malware to the victims’ systems. APTs are incredibly sophisticated, stealthy and remain undetected for potentially long periods. They use zero-day or unknown vulnerabilities and are carried out by adversaries possessing a very high level of expertise and deploying significant resources for the primary purpose of data exfiltration or positioning for long term attack strategies. The current defence security solutions are a combination of Intrusion Detection and Prevention Systems (IDPS), Security Operations Centre (SOC), anomaly and heuristic-based endpoint protection systems, etc. However, IDPS face several problems in mitigating APT attacks, such as a lack of historical correlation of attack data, knowledge of defence against known APT attacks stages only. This chapter explores Blockchain distributed technology and its applicability towards cybersecurity defence and explores a new system in defence against APT attacks called Blockchain Advanced Persistent Threat Correlation Detection System (Orion System), implemented as chaincode micro-smart contracts. © 2021, The Author(s), under exclusive license to Springer Nature Switzerland AG.