DARKMENTION: A Deployed System to Predict Enterprise-Targeted External Cyberattacks

Abstract

Recent incidents of data breaches call for organizations to proactively identify cyber attacks on their systems. Darkweb/Deepweb (D2web) forums and marketplaces provide environments where hackers anonymously discuss existing vulnerabilities and commercialize malicious software to exploit those vulnerabilities. These platforms offer security practitioners a threat intelligence environment that allows to mine for patterns related to organization-targeted cyber attacks. In this paper, we describe a system (called DARKMENTION) that learns association rules correlating indicators of attacks from D2web to realworld cyber incidents. Using the learned rules, DARKMENTION generates and submits warnings to a Security Operations Center (SOC) prior to attacks. Our goal was to design a system that automatically generates enterprise-targeted warnings that are timely, actionable, accurate, and transparent. We show that DARKMENTION meets our goal. In particular, we show that it outperforms baseline systems that attempt to generate warnings of cyber attacks related to two enterprises with an average increase in F1 score of about 45% and 57%. Additionally, DARKMENTION was deployed as part of a larger system that is built under a contract with the IARPA Cyber-attack Automated Unconventional Sensor Environment (CAUSE) program. It is actively producing warnings that precede attacks by an average of 3 days.• timely: indicates the exact time-point in which a predicted attack will occur,• actionable: provides metadata/warning details, i.e., the target enterprise, type of attack, volume, and the software vulnerabilities/threat actor identified from the D2web discussions,• accurate: predicted unseen real-world attacks with an average increase in F1 of over 45% for one enterprise and 57% for the other, and• transparent: allows analysts to easily trace the warnings back to the rules that were triggered, discussions that fired the rules, etc.

Towards a Data-Driven Recommender System for Handling Ransomware and Similar Incidents

“…Recommender systems are also considered in vulnerability assessment and scoring [13], [14]. Identification of systems at risk via analysis of discussion on the darkweb can be found in work by Almukaynizi, et al [15]. Nevertheless, network defense and incident handling are lacking recommender systems or similar tools.…”

Security Operations Center: A Systematic Study and Open Challenges

“…• Security software: SIEM systems [80], intrusion detection/prevention systems [37], [103], [107], [128], [162], [173], [174], firewalls [37], [104], [127], [128], [174], anti-virus software [37], [111], [127], vulnerability scanners [173], identity and access management [104] • Network assets: Switches [104], [173], routers [104], [128], [173], servers [104], [127], [173], hosts [104], [173], proxies [174] • Virtualization environments: Hypervisor, virtual machine introspection, cloud environments [80] • Operational technology: Sensors, actuators, PLCs • Other Software: Open-Source Big Data Analytics [80], databases [173], identity and access management [173], mailserver [174], operating systems [111], [174] • Physical security assets: Security cameras, access control • External (Threat) Intelligence: Geolocation and DNS lookup [80], open source intelligence (OSINT) [47], [129], intelligence from threat sharing platforms or other organizations [130]- [132] • People:…”

Threats from the Dark: A Review over Dark Web Investigation Research for Cyber Threat Intelligence

“…In another work, Almukaynizi et al [26] introduced the DARKMENTION system that employs association rules to find correlations between threats mentioned on Dark and Deep Webs and real-world cyber incidents. By using the discovered correlations, the system generates warnings to cybersecurity organizations promptly.…”