Performance Evaluation Elastic Security as Open Source Endpoint Detection and Response for Advanced Persistent Threat Cyberattack

Abstract

Detecting APT using conventional information protection systems poses significant challenges. For instance, signature-based detection tools like antivirus primarily rely on predefined signature rules to identify malware. However, in scenarios like zero-day attacks where malware signatures are unknown, detection becomes unreliable. While EDR traditionally hinges on signature-based rules, recent advancements integrate machine learning techniques for enhanced detection capabilities. In this study, we conducted an evaluation of open-source EDR, specifically Elastic Security, for APT detection. APT attack vectors were simulated utilizing the Caldera Platform. The evaluation involved validating each attack vector sent by Caldera against detection alerts generated by Elastic Security. The detection outcomes revealed three categories: detected alerts conforming to predefined rules, undetected alerts despite predefined rules, and undetected alerts due to undefined rules. Some attack vectors lacked rule definitions, potentially resulting in elevated false positives. Additionally, certain attack vectors failed to trigger alerts despite rule definitions.