###### Abstract  
Advanced Persistent Threats (APTs) represent a complex series of techniques directed against a particular organization, where the perpetrator is able to hide its presence for a longer period of time (e.g., months, years). Previous such attacks have demonstrated the exceptional impact that a cyber attack may have on the operation of Supervisory Control And Data Acquisition Systems (SCADA), and, more specifically, on the underlying physical process. Existing techniques for the detection of APTs focus on aggregating results originating from a collection of anomaly detection agents. However, such approaches may require an extensive time period in case the process is in a steady-state. Conversely, this paper documents E-APTDetect, an approach that uses dynamic attestation and multi-level data fusion for the early detection of APTs. The methodology leverages sensitivity analysis and Dempster-Shafer's Theory of Evidence as its building blocks. Extensive experiments are performed on a realistic Vinyl Acetate Monomer (VAM) process model. The model contains standard chemical unit operations and typical industrial characteristics, which make it suitable for a large variety of experiments. The experimental results conducted on the VAM process demonstrate E-APTDetect's ability to efficiently detect APTs, but also highlight key aspects related to the attacker's advantage. The experiments also highlight that the adversary's advantage is affected by two major factors: the number of compromised components; and, the precision of manipulation. SCADA; advanced persistent threats; data fusion; anomaly detection Article  
E-APTDetect: Early Advanced Persistent Threat Detection in Critical Infrastructures with Dynamic Attestation  
[PERSON]; [PERSON]; [PERSON]-S. E-APTDetect Early Advanced Persistent Threat Detection in Critical Infrastructures with Dynamic Attestation  
[PERSON]; [PERSON]; [PERSON]-S. E-APTDetect Early Advanced Persistent Threat Detection in Critical Infrastructures with Dynamic Attestation  
[PERSON]; [PERSON]; [PERSON]. combined with network segmentation and the deployment of these components in several parts of the network, can provide a first level of defense [4]. However, to address unknown attacks, anomaly detection proved to bring significant advantages in detecting abnormal behavior [5; 6]. In addition to these, recent techniques particularly address APTs by quantifying the output of a wide variety of anomaly detection algorithms and techniques [7; 8; 9; 10]. While previous APT detection techniques have focused on aggregating results originating from a collection of anomaly detection agents [8; 9; 11] that base their decisions on system observations, we consider a more proactive approach aimed to facilitate early APT detection. Accordingly, this paper documents E-APTDetect, an approach for the early detection of APTs that uses dynamic attestation. Attestation is an approach for verifying the behavior of remote devices. In this context, the entity that triggers the attestation is called attester, while the verified entity is called the attestee. In the case of dynamic attestation, the attester verifies the dynamic behavior of a running system (i.e., of the attestee) by issuing a challenge that triggers certain changes (e.g., in the execution flow). The attester then records the behavior of the attestee and compares it to an expected value in order to verify the runtime integrity of the attested system. To realize the concept of dynamic attestation, E-APTDetect uses system dynamics. System dynamics, originally proposed by [PERSON] [12], is an approach for understanding the behavior of complex systems over time. System dynamics has been used in various fields of science, including socio-economic systems, and policy, but in the context of industrial systems as well [13]. We adopt system dynamics as a way to enable attester agents to measure the change in the behavior of the physical process and then use this approach to assess the degree of deviation from normal according to the values learned apriori.