Detecting Advanced Persistent Threats (APT) via Sequences

Sophisticated adversaries design their individual actions to be unremarkable. A single failed authentication followed by success - routine. A process creating a network connection - normal system activity. A user accessing a system outside their usual hours - might be working late.

Each individual event, viewed in isolation, does not exceed detection thresholds. This is intentional. Adversaries who understand the defensive landscape know that individual events are monitored and design their activity accordingly. The signal of a sophisticated intrusion is in the sequence - the pattern of events over time that, taken together, reveals the attack progression even when each individual step is individually defensible.

Comparing Threat Detection Approaches

Single-Event Alerting vs. Sequence-Based APT Modeling

Sequence Analysis: How to Detect Campaigns, Not Just Events

Sequence analysis in security is the application of temporal pattern modeling to this problem. Instead of asking "does this event match a known-bad pattern?" it asks "does this sequence of events, evaluated as a temporal chain, match the structure of known attack progressions?"

The conceptual foundation is sound: adversary intrusions, despite their diversity in technique and target, have recognizable structural patterns.

1. Initial Access through one of a defined set of entry points.
2. Internal Discovery to map the host and network environment.
3. Privilege Escalation to expand administrative capability.
4. Lateral Movement toward high-value target assets.
5. Data Collection & Exfiltration of target intellectual property or sensitive records.

The specific techniques at each stage vary widely, but the progression has structural regularities that can be modeled.

Data Engineering Prerequisites for Sequence Modeling

At Netenrich, we apply sequence modeling on top of our behavioral analytics layer using the UDM-normalized, entity-resolved, enriched event stream. A behavioral anomaly alone may not justify an alert - it is one event that deviates from baseline. The same anomaly, occurring in the context of a sequence that matches known attack progression patterns with statistical significance, is a very different signal.

The data requirements for reliable sequence analysis are demanding.

• Complete Telemetry Coverage: Gaps in the event record create gaps in sequence representation, producing unreliable pattern matching.
• Accurate Timestamps: Sequence order and precise delta timing are both critical features of the underlying mathematical models.
• Entity Resolution: Sequences that span multi-cloud boundaries require reliable tracking of the same user or asset identity across systems.

These requirements point back, as they always do, to the foundational data engineering work. Sequence analysis that operates on poor data produces sophisticated noise. On our data foundation, it produces campaign-level detection that no event-level rule can replicate.

The adversary is running a campaign. Detection that operates at the campaign level is what matches the adversary's operational unit.

*Part of my ongoing series on data science and the future of security operations.*

 
About the Author