Design and Development of Automated Threat Hunting in Industrial Control Systems

Arafune, Masumi; Sidharth, Rajalakshmi,; Luigi, Jaldon,; Jadidi, Zahra; Pal, Shantanu; Foo, Ernest; Venkatachalam, Nagarajan

doi:10.1109/percomworkshops53856.2022.9767375

Cited by 14 publications

(9 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A related contribution was made by Arafune et al [2]. They aim to predict the future steps of the attacker through threat attribution using adversarial TTs.…”

Section: A Cyber Threat Attribution and Related Topicsmentioning

confidence: 99%

Section: A Experiments Designmentioning

confidence: 99%

“…To the best of our knowledge, no good public dataset exists for studying threat attribution 2 . Prior work has either scraped the internet [2], [5], or used labeled sandboxed malware executions [6]. The representativeness of each of these methods is imperfect, and a perfectly representative dataset is unachievable due to the adversarial nature of the domain.…”

Section: A Experiments Designmentioning

confidence: 99%

“…While several proposals have been made to automate threat attribution [2], [5], [6], these systems are not easily compared or combined despite their similar or related goals. Current research tackles threat attribution as a complex monolithic problem or even as part of another problem, hence hindering the adaptation or reuse of components.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A Modular Approach to Automatic Cyber Threat Attribution using Opinion Pools

Teuwen

2023

2023 IEEE International Conference on Big Data (BigData)

View full text Add to dashboard Cite

Cyber threat attribution can play an important role in increasing resilience against digital threats. Recent research focuses on automating the threat attribution process and on integrating it with other efforts, such as threat hunting. To support increasing automation of the cyber threat attribution process, this paper proposes a modular architecture as an alternative to current monolithic automated approaches. The modular architecture can utilize opinion pools to combine the output of concrete attributors. The proposed solution increases the tractability of the threat attribution problem and offers increased usability and interpretability, as opposed to monolithic alternatives. In addition, a Pairing Aggregator is proposed as an aggregation method that forms pairs of attributors based on distinct features to produce intermediary results before finally producing a single Probability Mass Function (PMF) as output. The Pairing Aggregator sequentially applies both the logarithmic opinion pool and the linear opinion pool. An experimental validation suggests that the modular approach does not result in decreased performance and can even enhance precision and recall compared to monolithic alternatives. The results also suggest that the Pairing Aggregator can improve precision over the linear and logarithmic opinion pools. Furthermore, the improved k-accuracy in the experiment suggests that forensic experts can leverage the resulting PMF during their manual attribution processes to enhance their efficiency.

show abstract

“…A related contribution was made by Arafune et al [2]. They aim to predict the future steps of the attacker through threat attribution using adversarial TTs.…”

Section: A Cyber Threat Attribution and Related Topicsmentioning

confidence: 99%

Section: A Experiments Designmentioning

confidence: 99%

Section: A Experiments Designmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Modular Approach to Automatic Cyber Threat Attribution using Opinion Pools

Teuwen

2023

2023 IEEE International Conference on Big Data (BigData)

View full text Add to dashboard Cite

show abstract

“…At the most basic level, threat hunting can simply consist of manual analysis of network or Windows logs. In contrast, [26] proposes a sophisticated threat hunting model which utilises machine learning to automatically generate threat intelligence based on data from a variety of sources.…”

Section: Data Validitymentioning

confidence: 99%

Challenges and Opportunities of Blockchain for Cyber Threat Intelligence Sharing

Dunnett¹,

Pal²,

Jadidi³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

The emergence of the Internet of Things (IoT) technology has caused a powerful transition in the cyber threat landscape. As a result, organisations have had to find new ways to better manage the risks associated with their infrastructure. In response, a significant amount of research has focused on developing efficient Cyber Threat Intelligence (CTI) sharing platforms. However, most existing solutions are highly centralised and do not provide a way to exchange information in a distributed way. In this chapter, we subsequently seek to evaluate how blockchain technology can be used to address a number of limitations present in existing CTI sharing platforms. To determine the role of blockchain-based sharing moving forward, we present a number of general CTI sharing challenges, and discuss how blockchain can bring opportunities to address these challenges in a secure and efficient manner. Finally, we discuss a list of relevant works and note some unique future research questions.

show abstract