Cyber Threat Intelligence: Challenges and Opportunities

Conti, Mauro; Dargahi, Tooska; Dehghantanha, Ali

doi:10.1007/978-3-319-73951-9_1

Cited by 101 publications

(53 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…After that, attackers take intrusive actions to bring about great loss to benign users. As widely accepted, cyber kill-chain is a multistage segmental type intrusive model proposed by Lockheed Martin cooperation [3] and now has been widely accepted. It describes the common intrusive behavioral pattern with two stages.…”

Section: Typical Offensive and Defensivementioning

confidence: 99%

Moving Target Defense Techniques: A Survey

Cheng

Zhang

Jian-cheng

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

As an active defense technique to change asymmetry in cyberattack-defense confrontation, moving target defense research has become one of the hot spots. In order to gain better understanding of moving target defense, background knowledge and inspiration are expounded at first. Based on it, the concept of moving target defense is analyzed. Secondly, literature analysis method is adopted to explain the design principles and system architecture of moving target defense. In addition, some relevant key techniques are introduced from the aspects of strategy generation, shuffling implementation, and performance evaluation. After that, the applications of moving target defense in different network architectures are illustrated. Finally, existing problems and future trend in this field are elaborated so as to provide a basis for further study.

show abstract

Section: Typical Offensive and Defensivementioning

confidence: 99%

Moving Target Defense Techniques: A Survey

Cheng

Zhang

Jian-cheng

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…As a consequence, botnet and IDS data analysis has attracted alternative areas of research, for instance, ML-based solutions. Prominent ML approaches facilitated the disclosure of underlying patterns of traffic flows, pointing out the importance of feature engineering (feature extraction and selection) and evaluating malicious traces with different assessments to reach higher accuracy in real implementations [19]. The authors in [20] addressed botnet and IDS detection relying on two notable ML ramifications, Supervised (SL) and Unsupervised Learning (UL).…”

Section: Related Workmentioning

confidence: 99%

Synthetic Minority Oversampling Technique for Optimizing Classification Tasks in Botnet and Intrusion-Detection-System Datasets

et al. 2020

View full text Add to dashboard Cite

Presently, security is a hot research topic due to the impact in daily information infrastructure. Machine-learning solutions have been improving classical detection practices, but detection tasks employ irregular amounts of data since the number of instances that represent one or several malicious samples can significantly vary. In highly unbalanced data, classification models regularly have high precision with respect to the majority class, while minority classes are considered noise due to the lack of information that they provide. Well-known datasets used for malware-based analyses like botnet attacks and Intrusion Detection Systems (IDS) mainly comprise logs, records, or network-traffic captures that do not provide an ideal source of evidence as a result of obtaining raw data. As an example, the numbers of abnormal and constant connections generated by either botnets or intruders within a network are considerably smaller than those from benign applications. In most cases, inadequate dataset design may lead to the downgrade of a learning algorithm, resulting in overfitting and poor classification rates. To address these problems, we propose a resampling method, the Synthetic Minority Oversampling Technique (SMOTE) with a grid-search algorithm optimization procedure. This work demonstrates classification-result improvements for botnet and IDS datasets by merging synthetically generated balanced data and tuning different supervised-learning algorithms.

show abstract

“…Viime vuosien aikana kyberhyökkäykset ovat lisääntyneet ja monimutkaistuneet, jonka vuoksi niiden havaitsemiseen, analysointiin ja suojaukseen tarvitaan yhä enemmän reaaliaikaista tietoa (Conti, Dargahi & Dehghantanha, 2018). Samaan aikaan kerätyn tiedon määrä jatkaa kasvamistaan.…”

Section: Johdantounclassified

Cyber Threat Intelligence

Dehghantanha¹,

Conti²,

Dargahi³

2018

Advances in Information Security

View full text Add to dashboard Cite

Maailman digitalisoitumisen seurauksena kerätyn datan määrä on kasvanut eksponentiaalisesti, tietojärjestelmät ovat monimutkaistuneet ja kyberhyökkäykset kehittyneet teknologian kehityksen mukana, jonka vuoksi perinteiset kyberhyökkäyksen torjuntamenetelmät eivät enää yksinään riitä suojaamaan organisaatioita. Tutkielmassa tarkastellaan miten Cyber Threat Intelligence edesauttaa organisaatioiden tietoturvaa ja mitä haasteita se tuo. Tutkielma on toteutettu kirjallisuuskatsauksena ja se pyrkii vastaamaan tutkimuskysymykseen: "Mitä on Cyber Threat Intelligence, miten se vaikuttaa ja mitä haasteita se tuo?". Kehittyneiden kyberhyökkäyksien takia yleistä toimintatapaa täytyisi siirtää hyökkäyksistä aiheutuneiden vahinkojen jälkikäteen korjaamisesta hyökkäyksien ennakoimiseen. Hyökkäyksien ennakoimiseen yksi tapa on hyödyntää Big Dataa, sillä kerätyn datan seasta loÿtyy vastauksia useampiinkin ongelmiin, mutta datan valtavan määrän ja monimutkaisuuden vuoksi, sitä on hidasta kerätä ja prosessoida sekä vaikea hallita. Uusi nouseva trendi on Cyber Threat Intelligence, jonka tarkoituksena on hyödyntää erilaisista lähteistä saatua analysoitua informaatiota kyberuhista ja sen perusteella tehdä päätöksiä tietoturvan parantamiseksi.

show abstract

Cyber Threat Intelligence: Challenges and Opportunities

Cited by 101 publications

References 14 publications

Moving Target Defense Techniques: A Survey

Moving Target Defense Techniques: A Survey

Synthetic Minority Oversampling Technique for Optimizing Classification Tasks in Botnet and Intrusion-Detection-System Datasets

Cyber Threat Intelligence

Contact Info

Product

Resources

About