Cyber-security system and methods thereof for detecting and mitigating advanced persistent threats

A non-transitory computer readable medium having stored thereon instructions for causing processing circuitry to execute a process for adaptively securing a protected entity against a potential advanced persistent threat (APT), the process comprising:

• probing a plurality of resources, including hosts, in a network prone to be exploited by an APT attacker for APT-related activity;
• operating at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources, wherein the at least one security service is an application behavior anomaly (UNABA) security service, and wherein operating the UNABA security service further comprises detecting APT related activity exploiting legitimate users in the network, wherein the APT attacker pretends normal behavior of the users;
• generating at least one security event based on the output signals;
• determining if the at least one security event satisfies at least one workflow rule;
• upon determining that the at least one security event satisfies the at least one workflow rule, generating at least one action with respect to the potential APT attack;
• maintaining a profile for each host, wherein the profile includes adaptive and real-time baseline parameters for the host's activity over a period of predefined time;
• computing, using a plurality of security decision engines, signals of anomaly (SoA) based on the probed APT related activity, the baseline parameters and a set of engine rules, wherein a SoA signal is output by the UNABA security service;
• correlating signals provided by other services with the computed SoA;
• and
• outputting the correlated signal.

A system for adaptively securing a protected entity against a potential advanced persistent threat (APT), comprising:

• a processor;
• and
• a memory, the memory containing instructions that, when executed by the processor, configure the system to:
• probe a plurality of resources, including hosts, in a network prone to be exploited by an APT attacker for APT-related activity;
• operate at least one security service configured to output signals indicative of APT related activity of each of the plurality of probed resources, wherein the at least one security service is an application behavior anomaly (UNABA) security service, and wherein operating the UNABA security service further comprises detecting APT related activity exploiting legitimate users in the network, wherein the APT attacker pretends normal behavior of the users;
• generate at least one security event based on the output signals;
• determine if the at least one security event satisfies at least one workflow rule;
• generate at least one action with respect to the potential APT attack, upon determining that the at least one security event satisfies the at least one workflow rule;
• maintain a profile for each host, wherein the profile includes adaptive and real-time baseline parameters for the host's activity over a period of predefined time;
• compute, using a plurality of security decision engines, signals of anomaly (SoA) based on the probed APT related activity, the baseline parameters and a set of engine rules, wherein a SoA signal is output by the UNABA security service;
• correlate signals provided by other services with the computed SoA;
• and
• output the correlated signal.