Acquiring Cyber Threat Intelligence through Security Information Correlation

Settanni, Giuseppe; Shovgenya, Yegor; Skopik, Florian; Graf, Roman; Wurzenberger, Markus; Fiedler, Roman

doi:10.1109/cybconf.2017.7985754

Cited by 23 publications

(11 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Data Collection [37], [47], [80], [103], [104], [107], [111], [127]- [132] Analysis & Detection [13], [35], [41], [43], [55], [56], [84], [133]- [157] Presentation [9], [12], [13], [80], [97], [99], [112], [127], [158]- [170] V-B2). As the interface between people and machines, the presentation of data and analysis results is of particular interest in a SOC context.…”

Section: Technology Referencesmentioning

confidence: 99%

“…DeCusatis [80] describes an attack visualization based on force diagrams and hive plots. Settani et al [158] shows how a map and dashboard-based visualization of incidents and a mobile visualization enables on-site personnel to make qualified decisions. Besides, Erola et al [159] present an approach that combines machine learning and information from business processes with visual analytics to guide SOC employees through the decision-making process.…”

Section: ) Presentationmentioning

confidence: 99%

See 1 more Smart Citation

Security Operations Center: A Systematic Study and Open Challenges

et al. 2020

View full text Add to dashboard Cite

Section: Technology Referencesmentioning

confidence: 99%

Section: ) Presentationmentioning

confidence: 99%

Security Operations Center: A Systematic Study and Open Challenges

et al. 2020

View full text Add to dashboard Cite

“…A commonly known malicious worm Stuxnet is an example of APT attack that targets production systems. The developers of these sophisticated attacks are skilled and well funded since they are tailor-made to the target networks and systems [1][2][3][4][5] -the cyber security risk at the targeted side is very high.…”

Section: Apt Attackmentioning

confidence: 99%

“…The attack can also use more than one attack vectors simultaneously. [1][2][3][4][5][6][7][8][9][10] Another weakness that help attackers is the fact that 100% secure systems does not exist. Even well designed and protected systems and networks have their weak spots [8].…”

Section: Apt Attackmentioning

confidence: 99%

“…The lifecycle of an APT attack begins when an attacker sets the target and intelligence gathering starts to find weak spots from the targeted cyber environment with methods such as open source intelligence, network scanning and social engineering [4,7]. The lifecycle may end due to various reasons: the attack reaches its purpose, it is detected and interrupted or such countermeasures are implemented that it cannot fulfil its purpose and therefore ceases.…”

Section: Lifecyclementioning

confidence: 99%

See 1 more Smart Citation

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

Bodström

Hämäläinen

2018

Computational Data and Social Networks

View full text Add to dashboard Cite

Advanced Persistent Threat(APT) attacks are a major concern for the modern societal digital infrastructures due to their highly sophisticated nature. The purpose of these attacks varies from long period espionage in high level environment to causing maximal destruction for targeted cyber environment. Attackers are skilful and well funded by governments in many cases. Due to sophisticated methods it is highly important to study proper countermeasures to detect these attacks as early as possible. Current detection methods under-performs causing situations where an attack can continue months or even years in a targeted environment. We propose a novel method for analysing APT attacks through OODA loop and Black Swan theory by defining them as a multivector multi-stage attacks with continuous strategical ongoing campaign. Additionally it is important to notice that for developing better performing detection methods, we have to find the most common factor within these attacks. We can state that the most common factor of APT attacks is communication, thus environment has to be developed in a way that we are able to capture complete network flow and analyse it.

show abstract

Security risks in cyber physical systems—A systematic mapping study

Zahid

Inayat

Daneva

et al. 2021

J Software Evolu Process

View full text Add to dashboard Cite

The increased need for constant connectivity and complete automation of existing systems fuels the popularity of Cyber Physical Systems (CPS) worldwide. Increasingly more, these systems are subjected to cyber attacks. In recent years, many major cyber‐attack incidents on CPS have been recorded and, in turn, have been raising concerns in their users' minds. Unlike in traditional IT systems, the complex architecture of CPS consisting of embedded systems integrated with the Internet of Things (IoT) requires rather extensive planning, implementation, and monitoring of security requirements. One crucial step to planning, implementing, and monitoring of these requirements in CPS is the integration of the risk management process in the CPS development life cycle. Existing studies do not clearly portray the extent of damage that the unattended security issues in CPS can cause or have caused, in the incidents recorded. An overview of the possible risk management techniques that could be integrated into the development and maintenance of CPS contributing to improving its security level in its actual environment is missing. In this paper, we are set out to highlight the security requirements and issues specific to CPS that are discussed in scientific literature and to identify the state‐of‐the‐art risk management processes adopted to identify, monitor, and control those security issues in CPS. For that, we conducted a systematic mapping study on the data collected from 312 papers published between 2000 and 2020, focused on the security requirements, challenges, and the risk management processes of CPS. Our work aims to form an overview of the security requirements and risks in CPS today and of those published contributions that have been made until now, towards improving the reliability of CPS. The results of this mapping study reveal (i) integrity authentication and confidentiality as the most targeted security attributes in CPS, (ii) model‐based techniques as the most used risk identification and assessment and management techniques in CPS, (iii) cyber‐security as the most common security risk in CPS, (iv) the notion of “mitigation measures” based on the type of system and the underline internationally recognized standard being the most used risk mitigation technique in CPS, (v) smart grids being the most targeted systems by cyber‐attacks and thus being the most explored domain in CPS literature, and (vi) one of the major limitations, according to the selected literature, concerns the use of the fault trees for fault representation, where there is a possibility of runtime system faults not being accounted for. Finally, the mapping study draws implications for practitioners and researchers based on the findings.

show abstract

Acquiring Cyber Threat Intelligence through Security Information Correlation

Cited by 23 publications

References 12 publications

Security Operations Center: A Systematic Study and Open Challenges

Security Operations Center: A Systematic Study and Open Challenges

A Novel Method for Detecting APT Attacks by Using OODA Loop and Black Swan Theory

Security risks in cyber physical systems—A systematic mapping study

Contact Info

Product

Resources

About