Cyber Attacker of the Future

This paper identifies the role of cyber attackers in future APTs, evaluating different aspects and combat strategies.

Running head: CYBER ATTACKER OF THE FUTURE
Cyber Attacker of the Future
Name of the Student
Name of the University
Author Note

1CYBER ATTACKER OF THE FUTURE
Table of Contents
Introduction................................................................................................................................2
Literature Review.......................................................................................................................2
Conclusion..................................................................................................................................7
Reference....................................................................................................................................8

2CYBER ATTACKER OF THE FUTURE
Introduction
The notable determination of this paper is to identify the role of the cyber attackers
who might be playing an active role in the future APTs. Different aspects of APT shall be
evaluated in the literature review unit of the paper from the perspective of numerous scholars
who have stated their opinion about the impact of APT. The intention of the social engineers
shall also be focused in this literature review. Comparative analysis shall be done in this
paper, at the same time, the combat strategies of APT shall also be identified in the literature
review.
Literature Review
As discussed by Aung & Oo (2016), advanced persistent threat (APT) can be defined
as the stealthy computer network threat actor, which are created by a group of social
engineer. These attacks cannot be detected easily and have the capability to destroy the
national economy of a nation within an hour. The prime intentions of the social engineers
behind these is to steal digital currency, spying on sensitive computer systems which contains
essential business documents, and disruption of services. It can also be observed that there are
circumstances when these attacks gets unnoticed and undetected. This data sources was
significant to understand that advanced planning and persistent IT operators are required for
APT (Xiao et al., 2015). Co-ordination between the groups of social engineers are required in
due course of this attack.
APT was detected in the first place in the year 2005 and the notable targets of the
social engineers who are associated with APT were also specified in this data source such as
the education industry, financial institutions, banking organizations, energy sector,
transportation industry, healthcare industry, telecommunication industry, manufacturing
industry and agriculture (Webb et al., 2014). The life cycle of APT was highlighted in this

3CYBER ATTACKER OF THE FUTURE
article in a detailed manner in terms of the cover tracks, exfiltrate data, finding and
organization of the accomplices, building for acquire tools, research target, testing fir
detection, intrusion detection, outbound connection initiated. Expand access and obtain
credentials, strengthen foothold, and cover tracks and remain undetected. The usability of
maintaining this life cycle was stated by the investigators of this data source. The different
categories of malware variations used by the social engineers during the APT was considered
by the investigators of this article. The prime strength of this article is the detailed discussion
of the different industries which are vulnerable to the APT (Zhao et al., 2015). On the other
hand there are few limitations associated with this data source as well in terms of the lack of
real life examples of APT which might have improved transparency of the entire procedure.
Thus, this paper is very much beneficial to understand the meaning and definition of APT in
a comprehensive manner.
However, as stated by Friedberg et al. (2016), the prime objective of the social
engineers who are involved in APT is only to compromise the data security. It can be
assumed that sensitive data are vulnerable to APT. The risk tolerance of APT is on the lower
side and huge knowledge and IT skills are required to order to create a risk mitigation
strategy for APT (Tounsi & Rais, 2018). The involvement of cyber criminals in each phase of
the APT is desired and it there are numerous categories of challenges associated with this
attack. The concept of zero day vulnerability associated with APT was highlighted by the
investigators of this article in a detailed manner. Zero day vulnerability is highly exploited by
the social engineers in order to spread APT. Different categories of malware are associated
with the APT such as Trojan Horse and Phishing Emails. Perceptions of the social engineers
is very significant in order to spread this deadly threat (Li et al., 2016). The risk tolerance of
the social engineers of this threats is much less than the social engineers of the other attacks
(Sharma et al., 2017). Most of the global establishments all over the worlds are vulnerable to

4CYBER ATTACKER OF THE FUTURE
APT and months of training modules are required for the social engineers to plan and execute
APT.
Organizational networking weaknesses are hugely capitalized by the social engineers
in order to spread APT. This data sources have both positives as well as negatives. The most
signification contribution of this data source is that, it described APT from different
perspectives unlike the discussions made by Tounsi & Rais (2018). On the other hand there
are few negatives associated with this data source in terms of the generalization of contents.
There are different aspects of APT in terms of the root cause of this threat. Thus, this paper
helped in understanding the APT from different perspectives.
As elaborated by Ghafir & Prenosil (2016), there are diverse categories of threats
which works in a similar manner as APT. Some of the threats coming from APT can surely
be restricted in the first place using the drop primitive authentication procedure. The
significance of the drop primitive authentication procedure was highlighted by the
investigators of this article in an organized manner. The role of the encryption key to save the
data from APT was highlighted in this article in an organized manner. The significance of the
preventing API access by the social engineers can be understood from the discussion of data
source. The protection which has to be given to the IP address of the users was highlighted by
the investigators of this data sources in an organized manner. The article helped in
understanding about the real time API issues which occurs due to APT. The authentication
flaws are the prime reasons behind the APT as stated by the investigators of this data source.
The concept of business logic vulnerability was highlighted by the investigators of this article
in an organised manner.
The introduction of the API calls are significant for the social engineers of APT as
instructed in this article (Moon et al., 2017). The paper concluded on the fact that bot

5CYBER ATTACKER OF THE FUTURE
management system can be useful to address the security threat coming from APT. The
attack detection systems are very useful to deal with the threat coming from APT which was
stated by the investigators of this article. This article highlighted both good and bad pints and
the most signification contribution of this rag is the detailed monitoring and management of
the API calls as these are one of the most significant reasons behind the recent APT. The
concept of drop primitive authentications was highlighted in this data source (Park & Hwang,
2018). It is important to understand that limiting the API access can be one of the most
significant risk mitigation for APT. The other significant discussion of this data source is that
it successfully identified the impact of the robust security plans which might also be
significant in order to contain the threats coming from APT (Zimba & Wang, 2017). IP
security testing is one of the safest procedure to protect a computer from APT as per the
discussions made in the paper (Moon et al., 2017). On the other hand, it can be said that
designing of the software and hardware must be done using secure programming language so
that their in built security system resist the system from APT. Fuzz testing is one other
significant testing procedure which might be helpful to deal with the threat coming from
APT. The command injection procedure is one of the most secure way to monitor the API
requests as per the discussion made in this data source (Li et al., 2016). There are no such
limitations associated with this article as it cover up most of the ways which might be useful
to prevent the threats coming from APT.
But according to Husar et al. (2018), monitoring of the unauthorized end points and
methods are required to contain the threats coming from APT. Unlike the previous data
source, this article have stated that significance of the automated tools which are useful in
order to deal with the threats coming from the end points. There are different categories of
HTTP methods which might also be one of the prime root cause of APT. The concept of
bypass authentication was introduced in the concluding section of this rag, according to the

6CYBER ATTACKER OF THE FUTURE
researchers bypass authentication is very significant to discover a vulnerability of a system,
and as a result it plays an active role to safeguard computer systems from APT (Li et al.,
2019). There are different ways to improve the security of the API as it one of the most
significant way to prevent APT. The significance of employee training in major commercial
organization so that the employees can be aware of the threats coming from APT as well as
the impact of this threat can be understood from the discussions made in this data source.
The likeliness and the probability of this threats has to be studied in the first in order to
minimise the impact of this security threat (Shenwen, Yingbo & Xiongjie 2015). The paper
suggested that the consumers of the reputed cloud service providers must be understand the
modus and techniques which are selected by the social engineers. Network Access Control
can be a significant procedure to prevent the threats coming from APT. Administration
controls of the dedicated systems are significant in order to prevent the threat coming from
APT (Li et al, 2016). Patch management system is required order to protect a commuter
system from cyber security threats and APT.
However, this article also stated that the website based firewall applications are not
enough to prevent threats coming from APT. It is important to identify the responsibility of
the intrusion detection system which might play a significant role in preventing APT. The
concept of penetration testing procedure was highlighted by the investigators of this article as
this one of the most popular ways to secure any private network from threats like APT
(Zimba & Wang, 2017). The existing security policies can be reviewed and re-examined in
the first place using the penetration testing. Most of the security vulnerabilities of commercial
organizations can be identified in the first place using the penetration testing as well.
Deployment of the User and entity behaviour analytics (UEBA) which is one of the most
indispensable tools which can be helpful to prevent the threats coming from APT. There are
numerous limitations which are associated with this article in terms of the lack of critical

7CYBER ATTACKER OF THE FUTURE
analysis whereas there are few advantages associated with this data source in terms of the
detailed explanation of the security policies which are usually helpful to deal with the threats
of APT.
However as quantified by Lemay et al., (2018), deception technology is one of the
most significant strategy which are required to combat the operational procedure of APT.
This technology is deployed to attract the fake servers and fake services which are sometimes
responsible for the APT threats. The networking monitoring procedure was also highlighted
by the investigators of this article. The investigators of this article also stated that the
detection of the payloads using the network monitoring procedure is one of the most
significant way to prevent the threat of APT. It is important to understand that there are
different categories of software vendors which can be useful to minimise the operational
procedure of APT (Zimba & Wang, 2017). This article have both limitations as well as
positives, the most significant contribution of this article is the detailed discussion of the
software vendors which can help an user to prevent their system from threats like APT.
However, there are few negatives associated with this article as it does not provided a case
study example regarding the enactment of the risk mitigation strategies which can be useful
to deal with the threats coming from APT (Li et al., 2016). Thus, this articles was useful to
understand the strategies which are needed to be taken in order to deal with the threat of APT.
Conclusion
Based on the above discussion made by the reputed scholars it can be concluded that
APT is mainly created by a group of cyber attackers and collaboration among each of them is
required to spread this threat. The discussion of these data sources also helps in concluding
that this threat might be undetected even after many days. The paper helped in understanding
that most of the global establishments all over the world is vulnerable to this threat and it

8CYBER ATTACKER OF THE FUTURE
might cause reputational and financial loss for those organizations. The impact of the security
plans and monitoring the unauthorized security points which can address the risk coming
from APT can also be concluded from the discussions. Usability of tools like UEBA which
can help to prevent APT was also concluded from this report.

9CYBER ATTACKER OF THE FUTURE
Reference
Aung, T. M., & Oo, M. M. (2016, February). Defensive Analysis on Web-Application Input
Validation for Advanced Persistent Threat (APT) Attack. Fourteenth International
Conference On Computer Applications (ICCA 2016).
Friedberg, I., Skopik, F., Settanni, G., & Fiedler, R. (2015). Combating advanced persistent
threats: From network event correlation to incident detection. Computers & Security,
48, 35-57. Friedberg, I., Skopik, F., Settanni, G., & Fiedler, R. (2015). Combating
advanced persistent threats: From network event correlation to incident detection.
Computers & Security, 48, 35-57.
Ghafir, I., & Prenosil, V. (2016). Proposed approach for targeted attacks detection. In
Advanced Computer and Communication Engineering Technology (pp. 73-80).
Springer, Cham.
Husari, G., Al-Shaer, E., Chu, B., & Rahman, R. F. (2019, April). Learning APT chains from
cyber threat intelligence. In Proceedings of the 6th Annual Symposium on Hot Topics
in the Science of Security (p. 19). ACM.
Lemay, A., Calvet, J., Menet, F., & Fernandez, J. M. (2018). Survey of publicly available
reports on advanced persistent threat actors. Computers & Security, 72, 26-59.
Li, M., Huang, W., Wang, Y., & Fan, W. (2016, October). The optimized attribute attack
graph based on APT attack stage model. In 2016 2nd IEEE International Conference
on Computer and Communications (ICCC) (pp. 2781-2785). IEEE.
Li, M., Huang, W., Wang, Y., Fan, W., & Li, J. (2016, June). The study of APT attack stage
model. In 2016 IEEE/ACIS 15th International Conference on Computer and
Information Science (ICIS) (pp. 1-5). IEEE.

10CYBER ATTACKER OF THE FUTURE
Li, Y., Wang, R., & Li, H. (2019, April). NGSIEM Based APT Attack Analysis System. In
IOP Conference Series: Earth and Environmental Science (Vol. 252, No. 5, p.
052160). IOP Publishing.
Moon, D., Im, H., Kim, I., & Park, J. H. (2017). DTB-IDS: an intrusion detection system
based on decision tree using behavior analysis for preventing APT attacks. The
Journal of supercomputing, 73(7), 2881-2895.
Park, S. U., & Hwang, S. M. (2018). Test Bed Construction for APT Attack Detection.
International Journal of Control and Automation, 11(4), 175-186.
Sharma, P. K., Moon, S. Y., Moon, D., & Park, J. H. (2017). DFA-AD: a distributed
framework architecture for the detection of advanced persistent threats. Cluster
Computing, 20(1), 597-609.
Shenwen, L., Yingbo, L., & Xiongjie, D. (2015, May). Study and research of APT detection
technology based on big data processing architecture. In 2015 IEEE 5th International
Conference on Electronics Information and Emergency Communication (pp. 313-
316). IEEE.
Tounsi, W., & Rais, H. (2018). A survey on technical threat intelligence in the age of
sophisticated cyber attacks. Computers & security, 72, 212-233.
Webb, J., Ahmad, A., Maynard, S. B., & Shanks, G. (2014). A situation awareness model for
information security risk management. Computers & security, 44, 1-15.
Xiao, L., Xu, D., Mandayam, N. B., & Poor, H. V. (2018). Attacker-centric view of a
detection game against advanced persistent threats. IEEE Transactions on Mobile
Computing, 17(11), 2512-2523.

11CYBER ATTACKER OF THE FUTURE
Zhao, G., Xu, K., Xu, L., & Wu, B. (2015). Detecting APT malware infections based on
malicious DNS and traffic analysis. IEEE access, 3, 1132-1142.
Zimba, A., & Wang, Z. (2017). Malware-free intrusions: Exploitation of built-in pre-
authentication services for APT attack vectors. International Journal of Computer
Network and Information Security, 9(7), 1.