$p=1$, this follows directly. Suppose the result holds for $p-1$, and let
$\mathbf{\hat{O}}_{B}=\mathop{\mathrm{d}iag}(\mathbf{\hat{O}}_{(1)},\ldots,\mathbf{\hat{O}}_{(p-1)})$,
so that

$\sup_{s\in\mathcal{S}}||\mathbf{\hat{O}}_{B}\mathbf{\hat{\varphi}}_{B}(s)-\mathbf{\varphi}_{B}(s)||=O_{p}(n^{-1/2}),$
(33)

with $\mathbf{\varphi}_{B}$ and $\mathbf{\hat{\varphi}}_{B}$ the vector of the
first $\sum_{j=1}^{p-1}m_{j}$ eigenfunctions. Now let

$\mathbf{\hat{O}}_{I}=\left(\begin{array}[]{cc}\mathbf{\hat{O}}_{11}&\mathbf{\hat{O}}_{12}\\\
\mathbf{\hat{O}}_{21}&\mathbf{\hat{O}}_{22}\end{array}\right)$

be the $(\sum_{j=1}^{p}m_{j})\times(\sum_{j=1}^{p}m_{j})$ matrix
$\mathbf{\hat{O}}_{n}$ of (30) applied with $q=\sum_{j=1}^{p}m_{j}$, with
$\mathbf{\hat{O}}_{11}$ of the same dimensions as $\mathbf{\hat{O}}_{B}$. Let
$\mathbf{\varphi}_{I-B}$ and $\mathbf{\hat{\varphi}}_{I-B}$ be the
$m_{p}\times 1$ vectors of eigenfunctions with indices
$\sum_{j=1}^{p-1}m_{j}+1,\ldots,\sum_{j=1}^{p}m_{j}$, so that by the
conclusion of (30),
$\sup_{s\in\mathcal{S}}||\mathbf{\hat{O}}_{11}\mathbf{\hat{\varphi}}_{B}(s)+\mathbf{\hat{O}}_{12}\mathbf{\hat{\varphi}}_{I-B}(s)-\mathbf{\varphi}_{B}(s)||=O_{p}(n^{-1/2})$
and
$\sup_{s\in\mathcal{S}}||\mathbf{\hat{O}}_{21}\mathbf{\hat{\varphi}}_{B}(s)+\mathbf{\hat{O}}_{22}\mathbf{\hat{\varphi}}_{I-B}(s)-\mathbf{\varphi}_{I-B}(s)||=O_{p}(n^{-1/2})$.
In conjunction with (33), the former yields
$\sup_{s\in\mathcal{S}}||(\mathbf{\hat{O}}_{11}-\mathbf{\hat{O}}_{B})\mathbf{\hat{\varphi}}_{B}(s)+\mathbf{\hat{O}}_{12}\mathbf{\hat{\varphi}}_{I-B}(s)||=O_{p}(n^{-1/2})$,
which implies in light of (30) and the linear independence of eigenvectors
that both $||\mathbf{\hat{O}}_{11}-\mathbf{\hat{O}}_{B}||=O_{p}(n^{-1/2})$ and
$||\mathbf{\hat{O}}_{12}||=O_{p}(n^{-1/2})$. Since $\mathbf{\hat{O}}_{I}$ and
$\mathbf{\hat{O}}_{B}$ are rotation matrices,
$\mathbf{\hat{O}}_{B}^{\prime}\mathbf{\hat{O}}_{B}=\mathbf{\hat{O}}_{11}^{\prime}\mathbf{\hat{O}}_{11}+\mathbf{\hat{O}}_{21}^{\prime}\mathbf{\hat{O}}_{21}=\mathbf{I}$,
so that $||\mathbf{\hat{O}}_{11}-\mathbf{\hat{O}}_{B}||=O_{p}(n^{-1/2})$
further implies $||\mathbf{\hat{O}}_{21}||=O_{p}(n^{-1/2})$. We conclude that
also
$\sup_{s\in\mathcal{S}}||\mathbf{\hat{O}}_{22}\mathbf{\hat{\varphi}}_{I-B}(s)-\mathbf{\varphi}_{I-B}(s)||=O_{p}(n^{-1/2})$,
so that the result for $p$ holds with
$\mathbf{\hat{O}}_{(p)}=\mathbf{\hat{O}}_{22}$, which concludes the proof.
$\blacksquare$

Proof of Theorem 7: Suppose
$\max(\overline{\mathop{\mathrm{c}v}}^{2}-\mathop{\mathrm{c}v}_{n}^{2},0)\overset{p}{\rightarrow}0$
does not hold. Then there exists $\delta>0$ such that
$\limsup_{n\rightarrow\infty}\mathbb{P}(\overline{\mathop{\mathrm{c}v}}^{2}-\mathop{\mathrm{c}v}_{n}^{2}>\delta)>\delta$.
Define
$\varkappa(\kappa,\overline{\mathop{\mathrm{c}v}}^{2})=\mathbb{P}\left(\sum_{i=0}^{\infty}\omega_{i}(\kappa,\overline{\mathop{\mathrm{c}v}})Z_{i}^{2}>0\right)$,
so that
$\sup_{0\leq\kappa<1}\varkappa(\kappa,\overline{\mathop{\mathrm{c}v}}^{2})=\alpha$
by definition of $\overline{\mathop{\mathrm{c}v}}$. By continuity of
$\varkappa$, there exists $0\leq\kappa_{0}<1$ and
$\overline{\mathop{\mathrm{c}v}}^{2}-\delta/2\leq\overline{\mathop{\mathrm{c}v}}_{0}^{2}\leq\overline{\mathop{\mathrm{c}v}}^{2}$
such that
$\varkappa(\kappa_{0},\overline{\mathop{\mathrm{c}v}}_{0}^{2})=\alpha$. If
$\kappa_{0}=0$, set $c_{n,1}=c_{n,0}$. Otherwise, let
$c_{n,1}\rightarrow\infty$ be such that the corresponding
$a_{n,1}=c_{n,1}^{d}/n\rightarrow a_{1}$ satisfies
$a_{1}\sigma_{B}^{0}(0)/(a_{1}\sigma_{B}^{0}(0)+\int\sigma_{B}^{0}(s)ds)=\kappa_{0}$.
Now let $\mathop{\mathrm{c}v}_{n,1}^{2}$ solve

$\mathbb{P}_{\mathbf{\Sigma(}c_{n,1})}^{0}(\tau_{n}^{2}\geq\mathop{\mathrm{c}v}_{n,1}^{2}|\mathbf{s}_{n})=\alpha\
\ \text{ a.s.},$

so that clearly,
$\mathop{\mathrm{c}v}_{n,1}^{2}\leq\mathop{\mathrm{c}v}_{n}^{2}$ a.s. for all
large enough $n$. Thus, with $\mathcal{A}_{n}$ the event that $\mathbf{s}_{n}$
takes on a value such that
$\overline{\mathop{\mathrm{c}v}}^{2}-\mathop{\mathrm{c}v}_{n^{\prime},1}^{2}>\delta$,
we also have $\limsup_{n\rightarrow\infty}\mathbb{P}(\mathcal{A}_{n})>\delta$,
and there exists a subsequence $n^{\prime}\rightarrow\infty$ of $n$ such that
$\mathbb{P}(\mathcal{A}_{n^{\prime}})>\delta$ for all $n^{\prime}$.

For all such $n^{\prime}$,

$\alpha=\mathbb{P}_{\mathbf{\Sigma(}c_{n^{\prime},1})}^{0}(\tau_{n^{\prime}}^{2}\geq\mathop{\mathrm{c}v}_{n^{\prime},1}^{2}|\mathcal{A}_{n^{\prime}})\geq\mathbb{P}_{\mathbf{\Sigma(}c_{n^{\prime},1})}^{0}(\tau_{n^{\prime}}^{2}\geq\overline{\mathop{\mathrm{c}v}}^{2}-\delta|\mathcal{A}_{n^{\prime}})\text{
a.s.}$ (34)

and by Theorem 4,
$\mathbb{P}_{\mathbf{\Sigma(}c_{n^{\prime},1})}^{0}(\tau_{n^{\prime}}^{2}\geq\overline{\mathop{\mathrm{c}v}}^{2}-\delta|\mathcal{A}_{n^{\prime}})\rightarrow\varkappa(\kappa_{0},\overline{\mathop{\mathrm{c}v}}^{2}-\delta)>\alpha$.
This contradicts (34), and the result follows. $\blacksquare$

######  Theorem 11.

Let $\hat{q}_{n}$ be an arbitrary function of $\mathbf{s}_{n}$ taking values
in $\mathcal{Q}=\\{1,2,\ldots,q_{\max}\\}$ for some sample size independent
finite and nonrandom $q_{\max}$. Then for a t-statistic $\tau_{n}(q)$ that
satisfies the conditions of Theorem 7 for all $q\in\mathcal{Q}$ with critical
value $\mathop{\mathrm{c}v}_{n}(q)$ as in (15), for any $\epsilon>0$,
$\lim\sup_{n\rightarrow\infty}\mathbb{P(P}(\tau_{n}^{2}(\hat{q}_{n})>\mathop{\mathrm{c}v}_{n}(\hat{q}_{n})^{2}|\mathbf{s}_{n})>\alpha+\epsilon)=0$.

###### Proof.

Suppose otherwise. Then there exists $\epsilon>0$ and a subsequence
$n^{\prime}\rightarrow\infty$ such that with
$\mathcal{B}_{n}=\\{\mathbf{s}_{n}:\mathbb{P}(\tau_{n}^{2}(\hat{q})>\mathop{\mathrm{c}v}_{n}(\hat{q})^{2}|\mathbf{s}_{n})>\alpha+\epsilon\\}\subset\mathcal{S}$,

$\lim_{n^{\prime}\rightarrow\infty}\mathbb{P(}\mathbf{s}_{n^{\prime}}\in\mathcal{B}_{n^{\prime}})>\epsilon\text{.}$

Let $\mathcal{A}_{n,i}=\\{\mathbf{s}_{n}:\hat{q}_{n}=i\\}$, so that
$\lim_{n^{\prime}\rightarrow\infty}\sum_{i=1}^{q_{\max}}\mathbb{P(}\mathbf{s}_{n^{\prime}}\in\mathcal{B}_{n^{\prime}}\cap\mathcal{A}_{n^{\prime},i})>\epsilon$.
There hence exists some $1\leq q\leq q_{\max}$ and a further subsequence
$n^{\prime\prime}$ of $n^{\prime}$ such that
$\lim_{n^{\prime\prime}}\mathbb{P(}\mathbf{s}_{n^{\prime\prime}}\in\mathcal{B}_{n^{\prime\prime}}\cap\mathcal{A}_{n^{\prime\prime},q})>\epsilon/q_{\max}$.
But along this subsequence, $q$ is fixed, so Theorem 7 applies and yields
$\lim_{n^{\prime\prime}\rightarrow\infty}\mathbb{P(}\mathbf{s}_{n^{\prime\prime}}\in\mathcal{B}_{n^{\prime\prime}}\cap\mathcal{A}_{n^{\prime\prime},q})\rightarrow
0$, yielding the desired contradiction.

The proof of Theorem 8 relies on some preliminary results.

######  Lemma 12.

The $\mathbb{R}^{q}\mapsto\mathbb{R}$ function

$J(\mathbf{\eta})=\frac{1}{\pi}\int_{0}^{1}\frac{x^{\frac{q-1}{2}}}{\sqrt{(1-x)\prod_{i=1}^{q}(x+\eta_{i})}}dx$

with $\mathbf{\eta}=(\eta_{1},\ldots,\eta_{q})$ is Schur convex.

###### Proof.

By the Schur-Ostrowski criterion (Theorem 3.A.4 in Marshall2011), $J$ is Schur
convex if (and only if)

$(\eta_{i}-\eta_{j})\left(\frac{\partial J}{\partial\eta_{i}}-\frac{\partial
J}{\partial\eta_{j}}\right)\geq 0\text{ for all }1\leq i,j\leq q\text{.}$

With $\tilde{J}=(x+\eta_{i})^{-1/2}(x+\eta_{j})^{-1/2}$, by a direct
calculation,

$(\eta_{i}-\eta_{j})\left(\frac{\partial\tilde{J}}{\partial\eta_{i}}-\frac{\partial\tilde{J}}{\partial\eta_{j}}\right)=\frac{(\eta_{i}-\eta_{j})^{2}}{2(x+\eta_{i})^{3/2}(x+\eta_{j})^{3/2}}\geq
0$

so the result follows.

######  Lemma 13.

For any two $q\times q$ positive semi-definite matrices $\mathbf{B}_{1}$ and
$\mathbf{B}_{2}$ and vectors $\mathbf{v}_{1},\mathbf{v}_{2}\in\mathbb{R}^{q}$,
and all $p\in[0,1]$,

$\varsigma(p)=(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})^{\prime}(\mathbf{I}_{q}+p\mathbf{B}_{1}+(1-p)\mathbf{B}_{2})^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})\\\
-p\mathbf{v}_{1}^{\prime}(\mathbf{I}_{q}+\mathbf{B}_{1})^{-1}\mathbf{v}_{1}-(1-p)\mathbf{v}_{2}^{\prime}(\mathbf{I}_{q}+\mathbf{B}_{2})^{-1}\mathbf{v}_{2}\leq
0\text{.}$

###### Proof.

We first show that $\varsigma(p)$ is convex. Write
$\mathbf{G}(p)=\mathbf{I}_{q}+p\mathbf{B}_{1}+(1-p)\mathbf{B}_{2}$. The first
derivative of the nonlinear part of $\tfrac{1}{2}\varsigma(p)$ is given by

$(\mathbf{v}_{1}-\mathbf{v}_{2})^{\prime}\mathbf{G}(p)^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})-\tfrac{1}{2}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})^{\prime}\mathbf{G}(p)^{-1}(\mathbf{B}_{1}-\mathbf{B}_{2})\mathbf{G}(p)^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})$

so that the second derivative of $\tfrac{1}{2}\varsigma(p)$ equals

$(\mathbf{v}_{1}-\mathbf{v}_{2})^{\prime}\mathbf{G}(p)^{-1}(\mathbf{v}_{1}-\mathbf{v}_{2})-2(\mathbf{v}_{1}-\mathbf{v}_{2})^{\prime}\mathbf{G}(p)^{-1}(\mathbf{B}_{1}-\mathbf{B}_{2})\mathbf{G}(p)^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})\\\
+(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})^{\prime}\mathbf{G}(p)^{-1}(\mathbf{B}_{1}-\mathbf{B}_{2})\mathbf{G}(p)^{-1}(\mathbf{B}_{1}-\mathbf{B}_{2})\mathbf{G}(p)^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2}).$

With $\mathbf{\Delta}(p)=\mathbf{G}(p)^{-1/2}(\mathbf{v}_{1}-\mathbf{v}_{2})$
and
$\mathbf{r}(p)=-\mathbf{G}(p)^{-1/2}(\mathbf{B}_{1}-\mathbf{B}_{2})\mathbf{G}(p)^{-1}(p\mathbf{v}_{1}+(1-p)\mathbf{v}_{2})$,
the second derivative may be rewritten as

$\left(\begin{array}[]{c}\mathbf{\Delta}(p)\\\
\mathbf{r}(p)\end{array}\right)^{\prime}\left(\begin{array}[]{cc}\mathbf{I}_{q}&\mathbf{I}_{q}\\\
\mathbf{I}_{q}&\mathbf{I}_{q}\end{array}\right)\left(\begin{array}[]{c}\mathbf{\Delta}(p)\\\
\mathbf{r}(p)\end{array}\right)\geq 0$

and convexity follows. Thus
$\max_{p\in[0,1]}\varsigma(p)\leq\max(\varsigma(1),\varsigma(0))=0$.

######  Lemma 14.

Let
$\mathbf{A}_{1}=\int\mathbf{P}^{-1}\mathbf{D}(\mathop{\mathrm{c}v})\mathbf{\Omega}(\theta)\mathbf{P}dF(\theta)$.
The $q+1$ eigenvalues of $\mathbf{A}_{1}$ are real, and only one is positive,
and the same holds for $\mathbf{A}(\theta)$, $\theta\in\Theta$. Furthermore,
$\lambda_{1}(\mathbf{A}_{1})\geq 1$.

###### Proof.

By similarity, the eigenvalues of $\mathbf{A}_{1}$ are equal to those of
$\mathbf{PA}_{1}\mathbf{P}^{-1}$, which in turn is similar to the symmetric
matrix

$\left(\begin{array}[]{cc}\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\\\
\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\end{array}\right)^{1/2}\left(\begin{array}[]{cc}1&0\\\
0&-\mathbf{I}_{q}\end{array}\right)\left(\begin{array}[]{cc}\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\\\
\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\end{array}\right)^{1/2}$

with $\mathbf{\tilde{W}=(l,W/}\mathop{\mathrm{c}v})$, and the first claim
follows for $\mathbf{A}_{1}$. The claim for $\mathbf{A}(\theta)$ follows from
the same argument.

For the last claim, let $\bar{h}:\mathbb{R}\mapsto\mathbb{R}$

$\bar{h}(t)=1-t\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}+t^{2}\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}(\mathbf{I}_{q}+t\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}.$

Note that $\bar{h}(t)$ is weakly decreasing in $t>0$, since with
$\mathbf{\tilde{H}}=-t\mathbf{\tilde{W}}(\mathbf{I}_{q}+t\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}$

$\bar{h}^{\prime}(t)=-\left(\begin{array}[]{c}\mathbf{l}\\\
\mathbf{\tilde{H}}\end{array}\right)^{\prime}\left(\begin{array}[]{cc}\mathbf{\Sigma}_{1}&\mathbf{\Sigma}_{1}\\\
\mathbf{\Sigma}_{1}&\mathbf{\Sigma}_{1}\end{array}\right)\left(\begin{array}[]{c}\mathbf{l}\\\
\mathbf{\tilde{H}}\end{array}\right)<0.$

The characteristic polynomial of $\mathbf{A}_{1}$ is given by

$\displaystyle\det\left(\begin{array}[]{cc}s-\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\\\
-\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}&s\mathbf{I}_{q}+\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}\end{array}\right)$
$\displaystyle=$
$\displaystyle(s-\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}+\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}(s\mathbf{I}_{q}+\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l})\det(s\mathbf{I}_{q}+\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})$
$\displaystyle=$ $\displaystyle
s\bar{h}(s^{-1})\det(s\mathbf{I}_{q}+\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})$

so that $\lambda_{1}(\mathbf{A}_{1})$ satisfies
$\bar{h}(1/\lambda_{1}(\mathbf{A}_{1}))=0$. Similarly,
$1/\lambda_{1}(\mathbf{A}(\theta))=1$ is a root of

$h_{\theta}(t)=1-t\mathbf{l}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{l}+t^{2}\mathbf{l}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{\tilde{W}}(\mathbf{I}_{q}+t\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{l}.$

By Lemma 13, for any $t>0$,

$\displaystyle\mathbf{l}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}}(\mathbf{I}_{q}+t\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}_{1}\mathbf{l}$
$\displaystyle=$
$\displaystyle\left(\int\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{l}dF(\theta)\right)^{\prime}\left(\mathbf{I}_{q}+t\int\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{\tilde{W}}dF(\theta)\right)^{-1}\left(\int\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{l}dF(\theta)\right)$
$\displaystyle\leq$
$\displaystyle\int\mathbf{l}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{\tilde{W}}(\mathbf{I}_{q}+t\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{\tilde{W}})^{-1}\mathbf{\tilde{W}}^{\prime}\mathbf{\Sigma}(\theta)\mathbf{l}dF(\theta).$

Thus, $\bar{h}(t)\leq\int h_{\theta}(t)dF(\theta)$, and from $h_{\theta}(1)=0$
for all $\theta$, $\bar{h}(1)\leq 0$. Since $h$ is decreasing, its root
$1/\lambda_{1}(\mathbf{A}_{1})$ must thus be smaller than unity, and the
conclusion follows.

Proof of Theorem 8: Proceeding as in the proof of Theorem 2,
$\mathbb{P}_{\mathbf{\Sigma}_{1}}(\tau^{2}(\mathbf{W}\mathbf{W}^{\prime})>\mathop{\mathrm{c}v}^{2})=\mathbb{P}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\bar{\eta}_{i}Z_{i}^{2}\right)$
with
$\bar{\eta}_{i}=\lambda_{i}\left(-\mathbf{A}_{1}\right)/\lambda_{1}(\mathbf{A}_{1})$.
By Lemma 14, $\bar{\eta}_{i}\geq 0$ for $i=1,\ldots,q$. For future reference,
note that
$\mathbb{P}_{\mathbf{\Sigma}_{0}}(\tau^{2}(\mathbf{W}\mathbf{W}^{\prime})>\mathop{\mathrm{c}v}^{2})=\alpha$
yields

$\mathbb{P}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\eta_{i}Z_{i}^{2}\right)\leq\alpha.$
(36)

for $\eta_{i}=\lambda_{i}\left(-\mathbf{A}_{0}\right)$.

In the following, we write $\mathbf{a}\prec\mathbf{b}$ for two vectors
$\mathbf{a},\mathbf{b}\in\mathbb{R}^{q}$ to indicate that $\mathbf{b}$
majorizes $\mathbf{a}$, that is, with the elements of $a_{i}$ and $b_{i}$
sorted in descending order,

$\sum_{i=1}^{j}a_{i}\leq\sum_{i=1}^{j}b_{i}\text{ for all }j=1,\ldots,q$

and $\sum_{i=1}^{q}a_{i}=\sum_{i=1}^{q}b_{i}$. Let
$\mathbf{\bar{A}}_{1}=\tfrac{1}{2}(\mathbf{A}_{1}+\mathbf{A}_{1}^{\prime})$.
From Theorems 9.F.1 and 9.G.1 in Marshall2011

$\displaystyle(\lambda_{1}(-\mathbf{A}_{1}),\ldots,\lambda_{q+1}(-\mathbf{A}_{1}))$
$\displaystyle\prec$
$\displaystyle(\lambda_{1}(-\mathbf{\bar{A}}_{1}),\ldots,\lambda_{q+1}(-\mathbf{\bar{A}}_{1}))$
$\displaystyle\prec$
$\displaystyle\left(\int\lambda_{1}(-\mathbf{\bar{A}}(\theta))dF(\theta),\ldots,\right.$
$\displaystyle\ \ \ \ \ \ \ \ \ \ \ \ \
\left.\int\lambda_{q}(-\mathbf{\bar{A}}(\theta))dF(\theta),\int\lambda_{q+1}(-\mathbf{\bar{A}}(\theta))dF(\theta)\right).$

Since
$\int\lambda_{q+1}(-\mathbf{\bar{A}}(\theta))dF(\theta)=-\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)$
and $\lambda_{q+1}(-\mathbf{A}_{1})=-\lambda_{1}(\mathbf{A}_{1})$, we have

$-\lambda_{1}(\mathbf{A}_{1})+\sum_{j=1}^{q}\lambda_{j}(-\mathbf{A}_{1})=-\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)+\sum_{j=1}^{q}\int\lambda_{j}(-\mathbf{\bar{A}}(\theta))dF(\theta).$

The majorization result (A) further implies

$\lambda_{1}(\mathbf{A}_{1})\leq\lambda_{1}(\mathbf{\bar{A}}_{1})\leq\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)$
(38)

so that also

$(\lambda_{1}(-\mathbf{A}_{1}),\ldots,\lambda_{q}(-\mathbf{A}_{1}))\prec\left(\int\lambda_{1}(-\mathbf{\bar{A}}(\theta))dF(\theta),\ldots,\right.\\\
\left.\int\lambda_{q-1}(-\mathbf{\bar{A}}(\theta))dF(\theta),\int\lambda_{q}(-\mathbf{\bar{A}}(\theta))dF(\theta)-\left(\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta))-\lambda_{1}(\mathbf{A}_{1})\right)\right).$

with the elements still sorted in descending order. Thus, with
$\tilde{\eta}_{i}=\int\lambda_{i}(-\mathbf{\bar{A}}(\theta))dF(\theta)/\lambda_{1}(\mathbf{A}_{1})$
for $i=1,\ldots,q-1$ and

$\tilde{\eta}_{q}=\frac{\int\lambda_{q}(-\mathbf{\bar{A}}(\theta))dF(\theta)-(\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta))-\lambda_{1}(\mathbf{A}_{1}))}{\lambda_{1}(\mathbf{A}_{1})}$

we have
$(\bar{\eta}_{1},\ldots,\bar{\eta}_{q})\prec(\tilde{\eta}_{1},\ldots,\tilde{\eta}_{q})$,
so that by (20) and Lemma 12,
$\mathbb{P}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\bar{\eta}_{i}Z_{i}^{2}\right)\leq\mathbb{\mathbb{P}}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\tilde{\eta}_{i}Z_{i}^{2}\right)$.

Now applying (38)

$\tilde{\eta}_{i}^{\ast}=\int\lambda_{i}(-\mathbf{\bar{A}}(\theta))dF(\theta)/\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)\leq\tilde{\eta}_{i}$

for $i=1,\ldots,q-1$, and since from Lemma 14,
$\lambda_{1}(\mathbf{A}_{1})\geq 1$, also

$\tilde{\eta}_{q}^{\ast}=\frac{\int\lambda_{q}(-\mathbf{\bar{A}}(\theta))dF(\theta)-(\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)-1)}{\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)}\leq\tilde{\eta}_{q}$

provided

$\int\lambda_{q}(-\mathbf{\bar{A}}(\theta))dF(\theta)-\left(\int\lambda_{1}(\mathbf{\bar{A}}(\theta))dF(\theta)-1\right)\geq
0.$ (39)

Since
$\mathbb{P}(Z_{0}^{2}\geq\left.\sum_{i=1}^{q}\tilde{\eta}_{i}Z_{i}^{2}\right.)$
is a decreasing function in $\tilde{\eta}_{i}$,
$\mathbb{P}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\tilde{\eta}_{i}Z_{i}^{2}\right)\leq\mathbb{P}\left(Z_{0}^{2}\geq\sum_{i=1}^{q}\tilde{\eta}_{i}^{\ast}Z_{i}^{2}\right).$
By Theorem 3.A.8 of Marshall2011, Lemma 12, and (36), it now suffices to show
that

$\sum_{i=1}^{j}\tilde{\eta}_{q+1-i}^{\ast}\geq\sum_{i=1}^{j}\eta_{q+1-i}$ (40)

for all $1\leq j\leq q$, and since $\eta_{q}\geq 0$, this also ensures that
(39) holds. Condition (40) may be rewritten as
$\sum_{i=1}^{j}\int\nu_{i}(\theta)dF(\theta)\geq 0$, and the result follows.
$\blacksquare$

## References

  * [1] [Andrews]Andrews1991Andrews91 Andrews, D. W. K. (1991): “Heteroskedasticity and Autocorrelation Consistent Covariance Matrix Estimation,” _Econometrica_ , 59, 817–858.
  * [2] [Bakirov and Székely]Bakirov and Székely2005Bakirov05 Bakirov, N. K., and G. J. Székely (2005): “Student’s T-Test for Gaussian Scale Mixtures,” _Zapiski Nauchnyh Seminarov POMI_ , 328, 5–19.
  * [3] [Berti, Pratelli, and Rigo]Berti, Pratelli, and Rigo2006Berti2006 Berti, P., L. Pratelli, and P. Rigo (2006): “Almost sure weak convergence of random probability measures,” _Stochastics: An International Journal of Probability and Stochastic Processes_ , 78(2), 91–97.
  * [4] [Bester, Conley, Hansen, and Vogelsang]Bester, Conley, Hansen, and Vogelsang2016Bester_Conley_Hansen_Vogelsang_2016 Bester, C., T. Conley, C. Hansen, and T. Vogelsang (2016): “Fixed-b Asymptotics for Spatially Dependent Robust Nonparametric Covariance Matrix Estimators,” _Econometric Theory_ , 32, 154–186.
  * [5] [Bester, Conley, and Hansen]Bester, Conley, and Hansen2011Bester11 Bester, C. A., T. G. Conley, and C. B. Hansen (2011): “Inference with Dependent Data Using Cluster Covariance Estimators,” _Journal of Econometrics_ , 165, 137–151.
  * [6] [Cao, Hansen, Kozbur, and Villacorta]Cao, Hansen, Kozbur, and Villacorta2020Cao2020 Cao, J., C. Hansen, D. Kozbur, and L. Villacorta (2020): “Inference for Dependent Data with Learned Clusters,” _Working paper_.
  * [7] [Chan and Wei]Chan and Wei1987Chan87 Chan, N. H., and C. Z. Wei (1987): “Asymptotic Inference for Nearly Nonstationary AR(1) Processes,” _The Annals of Statistics_ , 15, 1050–1063.
  * [8] [Conley and Molinari]Conley and Molinari2007Conley_Molinari_2007 Conley, T., and F. Molinari (2007): “Spatial Correlation Robust Inference with Errors in Location or Distance,” _Journal of Econometrics_ , 140, 76–96.
  * [9] [Conley]Conley1999Conley99 Conley, T. G. (1999): “GMM Estimation with Cross Sectional Dependence,” _Journal of Econometrics_ , 92, 1–45.
  * [10] [Dou]Dou2019Dou_2019 Dou, L. (2019): “Optimal HAR Inference,” _Working Paper, Princeton University_.
  * [11] [Elliott, Müller, and Watson]Elliott, Müller, and Watson2015Elliott15 Elliott, G., U. K. Müller, and M. W. Watson (2015): “Nearly Optimal Tests When a Nuisance Parameter is Present Under the Null Hypothesis,” _Econometrica_ , 83, 771–811.
  * [12] [Harkrishan]Harkrishan2017Vasudeva2017 Harkrishan, L. V. (2017): _Elements of Hilbert Spaces and Operator Theory_. Springer.
  * [13] [Henderson, Squires, Storeygard, and Weil]Henderson, Squires, Storeygard, and Weil2018Henderson_et_al_light Henderson, J., T. Squires, A. Storeygard, and D. Weil (2018): “The Global Distribution of Economic Activity: Nature, History, and the Role of Trade,” _Quarterly Journal of Economics_ , 133(1), 357–406.
  * [14] [Ibragimov and Müller]Ibragimov and Müller2010Ibragimov10 Ibragimov, R., and U. K. Müller (2010): “T-Statistic Based Correlation and Heterogeneity Robust Inference,” _Journal of Business and Economic Statistics_ , 28, 453–468.
  * [15] [Ibragimov and Müller]Ibragimov and Müller2016Ibragimov15  (2016): “Inference with Few Heterogeneous Clusters,” _Review of Economics and Statistics_ , 98(1), 83–96.
  * [16] [Kato]Kato1987Kato1987 Kato, T. (1987): “Variation of discrete spectra,” _Communications in Mathematical Physics_ , 111(3), 501–504.
  * [17] [Kelejian and Prucha]Kelejian and Prucha2007Kelejian2007 Kelejian, H. H., and I. R. Prucha (2007): “HAC estimation in a spatial framework,” _Journal of Econometrics_ , 140(1), 131 – 154.
  * [18] [Kelly]Kelly2019Kelly2019 Kelly, M. (2019): “The standard errors of persistence,” _University College Dublin WP19/13_.
  * [19] [Kiefer and Vogelsang]Kiefer and Vogelsang2005Kiefer05 Kiefer, N., and T. J. Vogelsang (2005): “A New Asymptotic Theory for Heteroskedasticity-Autocorrelation Robust Tests,” _Econometric Theory_ , 21, 1130–1164.
  * [20] [Kiefer, Vogelsang, and Bunzel]Kiefer, Vogelsang, and Bunzel2000Kiefer00 Kiefer, N. M., T. J. Vogelsang, and H. Bunzel (2000): “Simple Robust Testing of Regression Hypotheses,” _Econometrica_ , 68, 695–714.
  * [21] [Lahiri]Lahiri2003Lahiri_2003 Lahiri, S. (2003): “Central Limit Theorems for Weighted Sums of a Spatial Process under a Class of Stochastic and Fixed Designs,” _Sankhya_ , 65(2), 356–388.
  * [22] [Lahiri and Robinson]Lahiri and Robinson2016Lahiri2016 Lahiri, S., and P. M. Robinson (2016): “Central limit theorems for long range dependent spatial linear processes,” _Bernoulli_ , 22(1), 345–375.
  * [23] [Lazarus, Lewis, Stock, and Watson]Lazarus, Lewis, Stock, and Watson2018Lazarus_etal_JBES_2018 Lazarus, E., D. J. Lewis, J. H. Stock, and M. W. Watson (2018): “HAR Inference: Recommendations for Practice,” _Journal of Business and Economic Statistics_ , 36(4), 541–559.
  * [24] [Marshall, Olkin, and Arnold]Marshall, Olkin, and Arnold2011Marshall2011 Marshall, A. W., I. Olkin, and B. C. Arnold (2011): _Inequalities: theory of majorization and its applications_. Springer Series in Statistics, New York.
  * [25] [Müller]Müller2004Muller04 Müller, U. K. (2004): “A Theory of Robust Long-Run Variance Estimation,” _Working paper, Princeton University_.
  * [26] [Müller]Müller2007Muller07c  (2007): “A Theory of Robust Long-Run Variance Estimation,” _Journal of Econometrics_ , 141, 1331–1352.
  * [27] [Müller]Müller2014Muller14  (2014): “HAC Corrections for Strongly Autocorrelated Time Series,” _Journal of Business and Economic Statistics_ , 32, 311–322.
  * [28] [Müller]Müller2020Mueller2020 Müller, U. K. (2020): “A More Robust t-Test,” _arXiv:2007.07065_.
  * [29] [Müller and Norets]Müller and Norets2016Muller15c Müller, U. K., and A. Norets (2016): “Credibility of Confidence Sets in Nonstandard Econometric Problems,” _Econometrica_ , 84, 2183–2213.
  * [30] [Müller and Watson]Müller and Watson2016Muller14b Müller, U. K., and M. W. Watson (2016): “Measuring Uncertainty about Long-Run Predictions,” _Review of Economic Studies_ , 83\.
  * [31] [Müller and Watson]Müller and Watson2017Muller15d  (2017): “Low-Frequency Econometrics,” in _Advances in Economics: Eleventh World Congress of the Econometric Society_ , ed. by B. Honoré, and L. Samuelson, vol. II, pp. 63–94. Cambridge University Press.
  * [32] [Müller and Watson]Müller and Watsonin preparationMueller20  (in preparation): “Low-Frequency Analysis of Economic Time Series,” in _Handbook of Econometrics_. Elsevier.
  * [33] [Newey and West]Newey and West1987Newey87 Newey, W. K., and K. West (1987): “A Simple, Positive Semi-Definite, Heteroskedasticity and Autocorrelation Consistent Covariance Matrix,” _Econometrica_ , 55, 703–708.
  * [34] [Phillips]Phillips1987Phillips87b Phillips, P. C. B. (1987): “Towards a Unified Asymptotic Theory for Autoregression,” _Biometrika_ , 74, 535–547.
  * [35] [Phillips]Phillips2005Phillips05  (2005): “HAC Estimation by Automated Regression,” _Econometric Theory_ , 21, 116–142.
  * [36] [Rasmussen and Williams]Rasmussen and Williams2005Rasmussen05 Rasmussen, C. E., and C. K. I. Williams (2005): _Gaussian Processes for Machine Learning_. The MIT Press.
  * [37] [Robinson]Robinson2005Robinson05 Robinson, P. M. (2005): “Robust Covariance Matrix Estimation: HAC Estimates with Long Memory/Antipersistence Correction,” _Econometric Theory_ , 21, 171–180.
  * [38] [Rosasco, Belkin, and Vito]Rosasco, Belkin, and Vito2010Rosasco2010 Rosasco, L., M. Belkin, and E. D. Vito (2010): “On Learning with Integral Operators,” _Journal of Machine Learning Research_ , 11(30), 905–934.
  * [39] [Saitoh and Sawano]Saitoh and Sawano2016Saitoh2016 Saitoh, S., and Y. Sawano (2016): _Theory of Reproducing Kernels and Applications_. Springer, New York.
  * [40] [Sun]Sun2013Sun13 Sun, Y. (2013): “Heteroscedasticity and Autocorrelation Robust F Test Using Orthonormal Series Variance Estimator,” _The Econometrics Journal_ , 16, 1–26.
  * [41] [Sun and Kim]Sun and Kim2012Sun_Kim_2012 Sun, Y., and M. Kim (2012): “Asymptotic F-Test in a GMM Framework with Cross-Sectional Dependence,” _Review of Economics and Statistics_ , 91(1), 210–233.
  * [42] [Taqqu]Taqqu1975Taqqu1975 Taqqu, M. (1975): “Weak convergence to fractional Brownian motion and to the Rosenblatt process,” _Advances in Applied Probability_ , 7(2), 249.
  * [43] [Wang]Wang2014Wang2014 Wang, Y. (2014): “An Invariance Principle for Fractional Brownian Sheets,” _Journal of Theoretical Probability_ , 27(4), 1124–1139.
  * [44]


1 Gesellschaft für Informatik e.V. Informatik 2017 2017

# Anomaly Detection in Log Data using Graph Databases and Machine Learning to
Defend Advanced Persistent Threats

Timo Schindler111OTH Regensburg, Laboratory for Information Security,
Regensburg, Germany<EMAIL_ADDRESS>
###### Abstract

Advanced Persistent Threats (APTs) are a main impendence in cyber security of
computer networks. In 2015, a successful breach remains undetected 146 days on
average, reported by [Fi16]. With our work we demonstrate a feasible and fast
way to analyse real world log data to detect breaches or breach attempts. By
adapting well-known kill chain mechanisms and a combine of a time series
database and an abstracted graph approach, it is possible to create flexible
attack profiles. Using this approach, it can be demonstrated that the graph
analysis successfully detects simulated attacks by analysing the log data of a
simulated computer network. Considering another source for log data, the
framework is capable to deliver sufficient performance for analysing real-
world data in short time. By using the computing power of the graph database
it is possible to identify the attacker and furthermore it is feasible to
detect other affected system components. We believe to significantly reduce
the detection time of breaches with this approach and react fast to new attack
vectors.

###### keywords:

Advanded Persistent Threat Graph Database Intrusion Detection Machine Learning
Support Vector Machines Kill Chain

##  1 Introduction

Over the last 10 years, Vukalovic et al. show that a significant increase of
Advanced Persistent Threats (APTs) on companies in all industries can be
observed [VD15]. The Verizon Data Breach Investigations Report [Ve16] claims
that nearly 100% of all compromises are happening in less than a day, where
only about 10% of those compromises are discovered in a day or less. The
Fireeye report [Fi16] also shows that security breaches of computer systems in
2015 remained undiscovered for 146 days in average. In addition to that the
recent security breach at thyssenkrupp reported by [Ju16] and [Fi17], with a
time period of 45 days between breach and detection, shows that attackers have
enough time to interact undetected in an intruded system.

The report of [Fi16] furthermore illustrates that only 47% of the reported
compromises are detected by an internal discovery. Regarding APTs the attacker
is aware of the defense mechanisms and will camouflage his actions. Still
every attack creates anomalies or changes the behaviour of user accounts which
is represented in the raw log data. To achieve a APT detection, all log data
is analysed continuously, to create a profile, which represents regular
behaviour, where no attack takes place. Both, the profile creation and the
consolidation of the raw log data is achieved with graph databases by using an
adjusted kill chain model. With this kill chain model it is possible to
identify different attack vectors and increase the precision of the detection
rate. By introducing an abstracted event sequence layer, flexibility in
detecting divergent attacks is added to the graph database model and is an
efficient way to interpret multiple linked log events. To create and test this
attack vectors, a simulator is used to create malicious and clean (without
attacks) raw log data.

##  2 State of the Art

Intrusion Detection or Inrustion Prevention Systems (IDS and IPS) are
widespread approaches to detect security breaches or attacks ([De17, Ch17]).
Considering [LKT15] IDS are developed for signature and/or anomaly detection.
For signature detection, packets or audit logs are scanned to look for
sequences of commands or events which are previously determined as indicative
of an attack. Recently researchers are also working on innovative approaches
including data mining, statistical analysis and artificial intelligence
techniques (see [LKT15]; [Ma05]; [SZH05]; [CAY07]). Alongside IPS/IDS Security
Information and Event Management (SIEM) is a widely used approach to gain
security in companies and are also object of current research [Ye13]. [LKT15]
listed recent related work focusing on the task of anomaly detection based on
various data mining and machine learning techniques. Most studies are using
the KDD-Cup 99 [RI00] or DARPA 1999 [Li00] datasets. In the field of research
and also in existing solutions, data protection is no or just a minor issue.

##  3 Objective

The objective of this work is to create a feasible and efficient solution to
analyse various sets of log data and detect APT attacks in a reliable way. The
graph database approach demonstrates a way to analyse multiple interrelated
log events in a structured an straightforward process. To achieve this, an
abstraction layer is introduced, which is capable to react on divergent and
looping log events. By using a adapted kill chain model, different attack
vectors can be identified. This leads to a high level of confidence for the
case that several kill chain elements are met subsequently. The created
framework uses a state of the art SIEM system and widely used database
solutions for fast data processing. To comply to the German Federal Data
Protection Act (§3a BDSG222Bundesdatenschutzgesetz, Federal Data Protection
Act) all user related data has to be pseudonymised and the framework is able
to to work with pseudonymised data without limitations on precision. We proof
that this work leads to a flexible way to detect anomalies from raw log data
and is capable to be adjusted to several other Advanced Persistent Threats.

##  4 Graph based Kill Chain Analysis

To define different attacks or attack approaches, an adjusted kill chain is
used. In the kill chain process all steps of an adversary and its targets are
described by a series of events. The concept originates from US Department of
Defense [US07], has been adjusted by Hutchins [HCA11] and refined by Uetz
[Ue17] (see figure 1a). Figure 1a shows the adjusted kill chain model333The
kill chain elements ”1. Reconnaissance” and ”7. Prepare Exfiltration” are not
displayed. with deviating attack vectors444The green highlighted items are
representing a specific APT and will be used later.. Every kill chain item
represents a weak Indicator of Compromise (IoC), a signature which is used to
detect a potentially compromised system [Fo16]. This makes it possible to
identify different characteristics of APT attacks and react to different
approaches like ’2.1: Delivery with Spearphishing Email’ and ’2.2: Delivery
with USB Flash Drive’ (see fig. 1a).

### Graph-based Forensic Analysis

The adjusted kill chain model has been implemented as directed graph. Figure
1b shows the graph-database model where log events in chronological order
representing the first layer (_Events_ , blue). In most cases, an indicator is
built of several log events. Thus, a direct matching of log event to a kill
chain element is not intended. Between kill chain elements and log events, $n$
intermediate layers (_event sequences_) are established (purple). It is
possible to create several layers of event sequences and also to use loops to
illustrate the fact, that $n$ similar events can create a single event
sequence. If several corresponding event sequences match to the defined kill
chain elements, an APT can be detected by analysing previous or following
elements and their corresponding matches. After a cyber attack is detected, it
is possible to reconstruct the attack graph and find the security leak(s) and
the corresponding victims.

(a) Adjusted Kill Chain with an Example APT (b) Kill Chain Event Mapping with
Event Sequences

Figure 1: Detecting APT using Kill Chain Model in a Graph Database

### Anomaly Detection based on Machine Learning

Besides graph analysis, statistical and machine learning methods are
considered to identify attack vectors. For this approach, in a first step
windows log entries (e.g. login attempts or session times), firewalls and file
audits are taken into account. The SVM analysis is used to detect anomalies in
the user behaviour evoked by APT processes on the users machine. The collected
data is processed by several SVMs and a profile based on the normal user
behaviour is created. The machine learning mechanism detects anomalies, based
on the learned normal behaviour.

##  5 Proof of Concept Case Study

A specific APT is used to proof the detection concept: _Infecting a Windows
system by executing malicious code located in an PDF file delivered by an
infected spearphishing email, with the goal to exfiltrate all JPEG files._ For
this purpose two sets of log data sources are used: A security laboratory
(SecLab) for students with about 13 workstations, a domain controller,
firewall and proxy. A framework to simulate corporate networks and cyber
attacks with an arbitrary number of clients.

The logs of the above sources are aggregated with a state of the art
commercial SIEM system555Prolog, NETZWERK Software GmbH. While following
processing the log data gets pseudonymised, normalised and stored in a
InfluxDB instance, a time series database and the main source for all
analysis. To be able to revoke the pseudonymisation, the framework uses a
combination of a RSA cryptosystem and [Sh79] secret sharing.

### Graph-based Forensic Analysis

To be able to create log data of predefined attacks on a simulated company
network and easily set the same conditions for repetitive runs of these
attacks, the BREACH framework by Uetz et al. [Ue17] is used as one log source
set. The BREACH framework is being developed by FKIE666Fraunhofer-Institute
for Communication, Information Processing and Ergonomics (FKIE), Bonn, Germany
in cooperation with OTH Regensburg. The framework is capable to simulate
various attack vectors and can also simulate normal user behaviour in a
companies network fully controlled by the framework. The simulator consists of
a set of virtual machines simulating a medium sized enterprise network
infrastructure with about 100 users. All activities are logged and with the
intrusion reconstruction every step of the attack can be identified. Figure 1a
shows the specific kill chain structure which is used in the case study
(highlighted, green). The detection of the example APT requires further
analysis.

While the email is delivered to the client machine, the attacker starts a
generic HTTP handler which runs in standby mode initially and waits for
incoming connections. The exploit _Adobe Cooltype Sing_ described in [MI10] is
used. Through the handler further instructions can be delivered to the target.
In this case study the executed code searches for all JPEG image files on the
local hard drive and send them to the attacker.

All log data will be stored in the InfluxDB. While being processed with by
graph database, new nodes are created for all involved machines and the
algorithm matches the events to the affected sources. This leads to a
concatenated list of all events in a time period which are connected to the
machines they are caused by. The used algorithm for the graph analysis reveals
if a kill chain has been fulfilled completely or just parts of it. A complete
kill chain indicates a successful breach by the APT. Partly filled kill chains
can be further investigated, if a similar attack vector is used, and are a
first evidence for attacks.

### Anomaly Detection based on Machine Learning

The anomaly detection with machine learning mechanisms is based on data of
both data sources. For the used SVMs and one-class SVMs both classifications,
clean and malicious log data is needed. While a normal SVM separates multiple
predefined classes from each other, a one-class SVM is trained by the data of
one class and separates it from the data distinguishable from this class. The
feature vectors are based on file-audit, windows events (logon, logoff) and
firewall logs. For this malicious web traffic is generated with the BREACH
framework coupled with manual malicious downloads in the SecLab.

##  6 Evaluation

Considering our case study the graph database has successfully created event
sequences and linked the associated kill chain elements. The shown attack
involved the extraction of example confidential data, in this case JPEG files.
The amount of the extracted files is not known beforehand. The algorithm
managed to identify the attack correctly with a variable amount of
confidential data.

Figure 2 shows the graphical result representation of the graph analysis in
Neo4j777Figure 2 only shows a simplified representation for demonstration
propose.. The graph analysis successfully identifies the adversary (IP
172.18.0.3) of the simulation.

Figure 2: Result of Graph Analysis for APT

The example analysis is based on a simulated attack to one client with 1228
extracted log events (about 10 minutes of log data). In a real world scenario
much more log events even for a short period of time are created and need to
be processed by the graph database. With the second log source, the SecLab, it
is possible to provide a realistic log data situation.

The research with the SVMs and one-class SVMs has shown a high accuracy from
$95.33$% to $98.67$% when detecting anomalies in the log data. It could be
shown that in this case, the one-class SVMs had better results which can be
traced back to a high amount of clean log data. The data has shown, that there
is a higher rate of detection in simulator data than in user created data
which can be related to a more divergent behaviour of real world log data. The
SecLab data source is producing about 5 million events per week but
simulations have shown that the SVM approach is also capable to analyse a much
higher volume of log events. To proof this, the data has been expanded with
pseudo random data to proof the scalability.

##  7 Conclusion and Future Work

The purpose of this paper is to demonstrate that the use of a graph database
is a practicable way for a forensic analysis of log data. We have shown that
the abstracted event sequence graph model for matching to a kill chain
improves the automatic forensic analysis of log data. To achieve this we have
proposed an adjusted kill chain model as profound Indicator of Compromise. To
prove the theoretical concept, this framework was tested with an example
attack model and successfully detects the breach. We believe that this method
is suitable for a variation of different APT attack vectors due to its
flexibility.

The research with SVMs has already proven to be suitable to analyse massive
log data and return a high detection rate of anomalies. In the ongoing
research we want to focus on machine learning for automatic detection of
attack patterns and the creation of new attack sequences. For this approach we
can use the different data sources for tagged attacks and clean log data. In
addition to that, we will implement a fraud detection with fraud rings. This
approach will help to find connections between affected systems and to
identify potential additional breach victims. One major challenge to overcome
is the high variety of log data from different sources. To achieve a fast and
reliable framework we want to normalise and enrich the log data with
additional information.

## References

  * [CAY07] Yuehui Chen, Ajith Abraham and Bo Yang  “Hybrid flexible neural-tree-based intrusion detection systems”  In _International Journal of Intelligent Systems_ 22.4 Wiley Subscription Services, Inc., A Wiley Company, 2007, pp. 337–352  DOI: 10.1002/int.20203
  * [Ch17] Check Point  “Intrusion Prevention System Software Blade”, 2017  URL: https://www.checkpoint.com/products/ips-software-blade/
  * [De17] Dell Technologies  “Managed IDS/IPS”, 2017  URL: https://www.secureworks.com/capabilities/managed-security/network-security/managed-ids-ips
  * [Fi16] FireEye Inc.  “M-Trends Security Report 2016” Visited: 2016/10/1, 2016  URL: https://www.fireeye.com/current-threats/annual-threat-report/mtrends.html
  * [Fi17] Financial Times Ltd  “ThyssenKrupp reveals data stolen in cyber attack”, 2017  URL: https://www.ft.com/content/7b556fb8-bd43-11e6-8b45-b8b81dd5d080
  * [Fo16] Kevvie Fowler  “Data Breach Preparation and Response: Breaches are Certain, Impact is Not”  Elsevier Science, 2016  URL: https://books.google.de/books?id=m5SZBgAAQBAJ
  * [HCA11] Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin  “Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains”  In _6th Annual International Conference on Information Warfare and Security_ , 2011, pp. 1–14  URL: http://papers.rohanamin.com/wp-content/uploads/papers.rohanamin.com/2011/08/iciw2011.pdf$%5Cbackslash$nhttp://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf
  * [Ju16] Juergen Berke  “Warum Unternehmen eine eigene Cyberabwehr brauchen”, 2016  URL: http://www.wiwo.de/unternehmen/it/hackerangriff-auf-thyssenkrupp-warum-unternehmen-eine-eigene-cyberabwehr-brauchen/14968364.html
  * [Li00] Richard Lippmann et al.  “The 1999 DARPA off-line intrusion detection evaluation”  In _Computer Networks_ 34.4 Elsevier BV, 2000, pp. 579–595  DOI: 10.1016/s1389-1286(00)00139-0
  * [LKT15] Wei-Chao Lin, Shih-Wen Ke and Chih-Fong Tsai  “CANN: An intrusion detection system based on combining cluster centers and nearest neighbors.”  In _Knowl.-Based Syst._ 78, 2015, pp. 13–21  URL: http://dblp.uni-trier.de/db/journals/kbs/kbs78.html#LinKT15
  * [Ma05] G.. Marin  “Network security basics”  In _IEEE Security Privacy_ 3.6, 2005, pp. 68–72  DOI: 10.1109/MSP.2005.153
  * [MI10] MITRE Corporation  “CVE-2010-2883.”, Available from MITRE, CVE-2010-2883, 2010  URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2883
  * [RI00] Saharon Rosset and Aron Inger  “KDD-cup 99”  In _ACM SIGKDD Explorations Newsletter_ 1.2 Association for Computing Machinery (ACM), 2000, pp. 85  DOI: 10.1145/846183.846204
  * [Sh79] Adi Shamir  “How to Share a Secret”  In _Commun. ACM_ 22.11 New York, NY, USA: ACM, 1979, pp. 612–613  DOI: 10.1145/359168.359176
  * [SZH05] S.. Sarasamma, Q.. Zhu and J. Huff  “Hierarchical Kohonenen net for anomaly detection in network security”  In _IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics)_ 35.2, 2005, pp. 302–312  DOI: 10.1109/TSMCB.2005.843274
  * [Ue17] Rafael Uetz et al.  “BREACH: A Framework for the Simulation of Cyber Attacks on Company‘s Networks”  In _Digital Forensics Research Conference Europe (Poster)_ , 2017
  * [US07] U.S. Department of Defense  “Joint Publication 3-60 Joint Targeting”, 2007  URL: https://www.justsecurity.org/wp-content/uploads/2015/06/Joint%7B%5C_%7DChiefs-Joint%7B%5C_%7DTargeting%7B%5C_%7D20130131.pdf
  * [VD15] J. Vukalović and D. Delija  “Advanced Persistent Threats - detection and defense”  In _2015 38th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)_ , 2015, pp. 1324–1330  DOI: 10.1109/MIPRO.2015.7160480
  * [Ve16] Verizon  “Data Breach Investigations Report”, 2016  URL: http://www.verizonenterprise.com/verizon-insights-lab/dbir/2016/
  * [Ye13] Ting-Fang Yen et al.  “Beehive: Large-scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks”  In _Proceedings of the 29th Annual Computer Security Applications Conference_ , ACSAC ’13  New Orleans, Louisiana, USA: ACM, 2013, pp. 199–208  DOI: 10.1145/2523649.2523670

if you use biblatex/Biber