Advanced Persistent Threat (APT) cyberattacks are a major concern for both businesses and governments, making APT detection a crucial area in cybersecurity research. Detecting short-duration attack steps, also known as Tactics, Techniques, and Procedures (TTPs), has proven effective in assisting APT detection. However, existing incremental matching tools lack support for high-level pattern semantics, such as frequency and flow, causing potential inefficiency and evasion by slightly changing attack operations. To address this, we propose a feasible solution called IPMES+1, which incorporates intricate designs and optimizations. IPMES+ is the first TTP detection tool to provide incremental time-constrained graph-based pattern matching with frequency and flow semantics. Evaluations on synthetic and real-world datasets demonstrate that IPMES+ is not only necessary and feasible for enhancing practical TTP detection but also superior to existing tools that lack these advanced capabilities.

Advanced persistent threat (APT) cyberattacks are serious threats to corporations and governments. The prolong dwell time associated with APTs significantly increase the difficulty on detecting them in provenance graphs. To reduce the detection complexity, some works have demonstrated the effectiveness of employing pattern matching on provenance graphs in conjunction with APT lifecycle models to pinpoint short-duration attack steps, also known as “tactics, techniques, and procedures” (TTPs). However, when dealing with more complex TTPs, particularly those involving graph-based and partial ordering, few tools can incrementally and efficiently handle them. In this paper, we present IPMES11https://github.com/littleponywork/IPMES, a tool that has been publicly released to address this gap. By leveraging specific optimizations, it provides efficient incremental matching for those TTPs, and can handle practical system audit event streams. Experiments conducted on synthetic and real-world data demonstrated the practical feasibility of IPMES in TTP detection.

Speech recognition in noise environment is always inefficient for hearing-impaired people who wear hearing aids. Many noise cancellations have been proposed and studied for such an issue. In this paper, we designed a prototype of hearing instrument coupler to imitate the equivalent volume of the human ear, and built a feedforward active noise cancellation system (FANCs) that had the algorithm implemented with a digital signal processor (DSP) controller. The hearing instrument coupler is used to study the FANCs efficiency applied to real hearing aids. It is a chamber with an effective volume of 2cc specified by International Electrotechnical Commission (IEC) standard. The FANCs includes a reference microphone, an error microphone, a canceling loudspeaker and a DSP controller. The results show that the hearing instrument coupler could simulate an ear with hearing aid, and the FANCs could suppress the unwanted noise effectively to enhance speech recognition.