A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System

Lin, Yan; Wang, He; Yang, Bowen; Liu, Mingrui; Yin, Lei; Zhang, Yuqing

doi:10.1007/978-3-030-30619-9_18

Cited by 3 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This can always help the analysts for narrowing down the information available for acquiring the necessary knowledge. Hence, analysts can develop better decisions on reacting to incidents reported within CTI [3]. On the other hand, the knowledge on the domain from security experts is an important source of "fitness" of a particular CTI artifact.…”

Section: Introductionmentioning

confidence: 99%

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Alshehri¹

2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Cyber Threat Intelligence (CTI) has gained massive attention to collect hidden knowledge for a better understanding of the various cyber-attacks and eventually paving the way for predicting the future of such attacks. The information exchange and collaborative sharing through different platforms have a significant contribution towards a global solution. While CTI and the information exchange can help a lot in focusing and prioritizing on the use of the large volume of complex information among different organizations, there exists a great challenge ineffective processing of large count of different Indicators of Threat (IoT) which appear regularly, and that can be solved only through a collaborative approach. Collaborative approach and intelligence sharing have become the mandatory element in the entire world of processing the threats. In order to covet the complete needs of having a definite standard of information exchange, various initiatives have been taken in means of threat information sharing platforms like MISP and formats such as SITX. This paper proposes a scoring model to address information decay, which is shared within TISP. The scoring model is implemented, taking the use case of detecting the Threat Indicators in a phishing data network. The proposed method calculates the rate of decay of an attribute through which the early entries are removed.

show abstract

Section: Introductionmentioning

confidence: 99%

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Alshehri¹

2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

Crossover in mutation oriented norm evolution

Lv,

Wang,

Zhang

2024

Complex Intell. Syst.

View full text Add to dashboard Cite

Norms are a coordination mechanism. They control agents’ behavior in a multiagent system (MAS) and need to evolve to cope with changing environments. Mutation oriented norm evolution is a strategies for allowing norms to evolve. However, this strategy simply adds some possible trigger condition constraints on the norms, which means that some agents are unable to perform actions. To address this problem, this paper presents a new strategy for norm evolution based on an improved crossover operator. First, this paper presents a power-set approach to improve the integrity of norm evolution. This approach can help ensure that all possible combinations of norms are considered during the analysis, providing a deeper understanding of how norms interact and evolve within a norm set. Then, to improve the efficiency of norm evolution, a trade-off between efficiency and completeness is proposed. This approach reduces the search space and improves efficiency, as not every power set combination needs to be searched; it also ensures completeness. Finally, the crossover operator in this strategy is improved based on the trade-off approach. Specifically, the triggers and expectations of one mutated norm enrich the triggers and expectations of other norms. All of these factors enrich the normative conditions through the trade-off approach. A MAS can take immediate action to adapt to new requirements or problems encountered, and quickly make normative changes and learn to respond appropriately to a new situation. The MAS is able to more clearly understand and learn about causality in the environment during norm evolution, and understand the connection between behavior and outcomes. The proposed strategy is applied to a case study of an unmanned vehicle system. The experimental results show that the trade-off approach has greater completeness and effectiveness in norm evolution. This strategy achieves a more complete and effective autonomous norm evolution. It helps the system achieve its goals better and reach better performance in terms of adaptability, helping it to function better in complex multiagent environments.

show abstract

A Shared Cyber Threat Intelligence Solution for SMEs

Haastrecht

Golpur²,

Tzismadia³

et al. 2021

Electronics

View full text Add to dashboard Cite

Small- and medium-sized enterprises (SMEs) frequently experience cyberattacks, but often do not have the means to counter these attacks. Therefore, cybersecurity researchers and practitioners need to aid SMEs in their defence against cyber threats. Research has shown that SMEs require solutions that are automated and adapted to their context. In recent years, we have seen a surge in initiatives to share cyber threat intelligence (CTI) to improve collective cybersecurity resilience. Shared CTI has the potential to answer the SME call for automated and adaptable solutions. Sadly, as we demonstrate in this paper, current shared intelligence approaches scarcely address SME needs. We must investigate how shared CTI can be used to improve SME cybersecurity resilience. In this paper, we tackle this challenge using a systematic review to discover current state-of-the-art approaches to using shared CTI. We find that threat intelligence sharing platforms such as MISP have the potential to address SME needs, provided that the shared intelligence is turned into actionable insights. Based on this observation, we developed a prototype application that processes MISP data automatically, prioritises cybersecurity threats for SMEs, and provides SMEs with actionable recommendations tailored to their context. Subsequent evaluations in operational environments will help to improve our application, such that SMEs are enabled to thwart cyberattacks in future.

show abstract

A Blackboard Sharing Mechanism for Community Cyber Threat Intelligence Based on Multi-Agent System

Cited by 3 publications

References 22 publications

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Crossover in mutation oriented norm evolution

A Shared Cyber Threat Intelligence Solution for SMEs

Contact Info

Product

Resources

About