A Threat Hunting Framework for Industrial Control Systems

Jadidi, Zahra; Lü, Yi

doi:10.1109/access.2021.3133260

Cited by 31 publications

(9 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Threat hunting is defined by [24] and [25] as the proactive approach of seeking anomalous or malicious activity within an organisations cyber terrain. The process of performing this task, which if successful can result in the production of CTI, can be highly variable in nature.…”

Section: Data Validitymentioning

confidence: 99%

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

Dunnett¹,

Pal²,

Jadidi³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

The emergence of the Internet of Things (IoT) technology has caused a powerful transition in the cyber threat landscape. As a result, organisations have had to find new ways to better manage the risks associated with their infrastructure. In response, a significant amount of research has focused on developing efficient Cyber Threat Intelligence (CTI) sharing platforms. However, most existing solutions are highly centralised and do not provide a way to exchange information in a distributed way. In this chapter, we subsequently seek to evaluate how blockchain technology can be used to address a number of limitations present in existing CTI sharing platforms. To determine the role of blockchain-based sharing moving forward, we present a number of general CTI sharing challenges, and discuss how blockchain can bring opportunities to address these challenges in a secure and efficient manner. Finally, we discuss a list of relevant works and note some unique future research questions.

show abstract

Section: Data Validitymentioning

confidence: 99%

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

Dunnett¹,

Pal²,

Jadidi³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Internet‐connected devices are targeted by hackers through different tools and techniques, that is, the launching of malware attacks. Under the potential cyber attack, the online devices may be hijacked, their data may be leaked or altered, or devices get locked or unavailable to the authorized users 1,2 . Therefore, we need some cyber security mechanisms to detect and mitigate potential cyber threats and attacks.…”

Section: Introductionmentioning

confidence: 99%

“…As a result, taking a proactive approach is generally necessary, like cyber threat hunting 5 . Cyber threat hunting is part of cyber security, which makes user use “new threat intelligence” on the previously obtained information to recognize and categorize potential threats before their launching 1,2 …”

Section: Introductionmentioning

confidence: 99%

“…Under the potential cyber attack, the online devices may be hijacked, their data may be leaked or altered, or devices get locked or unavailable to the authorized users. 1,2 Therefore, we need some cyber security mechanisms to detect and mitigate potential cyber threats and attacks. The techniques under cyber threat hunting perform searching over the networks, connected devices, and servers to hunt the malicious and risky activities, which have evaded the detection process.…”

mentioning

confidence: 99%

“…5 Cyber threat hunting is part of cyber security, which makes user use "new threat intelligence" on the previously obtained information to recognize and categorize potential threats before their launching. 1,2 Cyber security is now utilizing the techniques of artificial intelligence (AI) to defend and mitigate potential cyber threats/attacks. However, the AI models are like the black-box and lack trust factor.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Kumar

Wazid

Singh

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

Cyber threat hunting proactively searches for cyber threats, which are undetected by the traditional defense mechanisms. It scans deep to identify malicious programs (ie, malware) that escape from detection. It is important because sophisticated cyber threats can bypass the cyber security mechanisms. The performance of the cyber threat hunting can be improved through artificial intelligence (AI), especially, explainable AI (XAI), which adds trust component to the cyber threat hunting process. Due to the inclusion of XAI, the security experts get the full explanations of the detected threats as the working of the detection model in XAI is known. Information, like, which one is a threat, how it has been detected, and why it has been detected, can be obtained very easily due to the inclusion of XAI in the cyber threat hunting. Therefore, an XAI‐envisioned mechanism for cyber threat hunting has been proposed (in short, XAISM‐CTH). The network and threat models of XAISM‐CTH are designed and discussed. The conducted security analysis proves the security of XAISM‐CTH against various potential attacks. XAISM‐CTH also performs better than the other existing schemes. At the end, a practical implementation of XAISM‐CTH has been provided to observe its impact on the performance of the system.

show abstract

Cybersecurity and process safety synergy: An analytical exploration of cyberattack‐induced incidents

Wen,

Khan

2023

Can J Chem Eng

View full text Add to dashboard Cite

In recent years, cyber‐connected industrial control systems (ICS) for remote operations have increased cyber and process risks. While process safety is widely studied, its connectivity with the cyber threat has not been well explored. It is crucial to study cybersecurity and process safety in an integrated way to ensure safe operations. This study addresses this gap by first analyzing the cyber incidents related to ICS since 1990. Subsequently, it connects cyber incidents with process accidents by Bowtie based on the ATT&CK framework. It further develops a Bayesian network due to the insignificant probabilities by Bowtie. The developed model is explained with case analysis. This study confirms that the process industry is prone to cyberattacks, and the field controllers are the main targets of attacks. The study observes that the safety instrument system (SIS) is critical for both the attackers and neutralizing the attacks (defenders). Moreover, attackers deploy newer approaches to attack the ICS, and therefore, methods of threat assessment and its neutralizing strategies should be dynamic.

show abstract

A Threat Hunting Framework for Industrial Control Systems

Abstract: Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000.

Cited by 31 publications

References 25 publications

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

Explainable artificial intelligence envisioned security mechanism for cyber threat hunting

Cybersecurity and process safety synergy: An analytical exploration of cyberattack‐induced incidents

Contact Info

Product

Resources

About