Informing Hybrid System Design in Cyber Security Incident Response

Nyre-Yu, Megan; Sprehn, Kelly A.; Caldwell, Barrett S.

doi:10.1007/978-3-030-22351-9_22

Cited by 6 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There have been several studies focusing on the analyst in a SOC. Yu [25] targets human interaction aspects to elicit functional requirements for automating tasks performed by a digital teammate Feng et al [9] developed a ML framework by generating labels from SOC notes in order to correlate IPaddresses, hosts and end-users. Akinrolabu et al [2] discovered valuable features (for ML models) by interviewing SOC analysts.…”

Section: B User-centric Soc Studiesmentioning

confidence: 99%

See 1 more Smart Citation

Towards XAI in the SOC – a user centric study of explainable alerts with SHAP and LIME

Eriksson

Grov

2022

2022 IEEE International Conference on Big Data (Big Data)

View full text Add to dashboard Cite

Many studies of the adoption of machine learning (ML) in Security Operation Centres (SOCs) have pointed to a lack of transparency and explanation -and thus trustas a barrier to ML adoption, and have suggested eXplainable Artificial Intelligence (XAI) as a possible solution. However, there is a lack of studies addressing to which degree XAI indeed helps SOC analysts. Focusing on two XAI-techniques, SHAP and LIME, we have interviewed several SOC analysts to understand how XAI can be used and adapted to explain ML-generated alerts. The results show that XAI can provide valuable insights for the analyst by highlighting features and information deemed important for a given alert. As far as we are aware, we are the first to conduct such a user study of XAI usage in a SOC and this short paper provides our initial findings.

show abstract

Section: B User-centric Soc Studiesmentioning

confidence: 99%

“…Several studies of SOC environments, including the use of AI in the SOC, have pointed towards adapting and using XAI techniques to support analysts [25], [7], [21], [9], [32], [2], [16], [26]. There have also been several attempts applying XAI to explain ML-generated alerts [39], [38], [28], [15], [20], [27], [34].…”

Section: Introductionmentioning

confidence: 99%

Towards XAI in the SOC – a user centric study of explainable alerts with SHAP and LIME

Eriksson

Grov

2022

2022 IEEE International Conference on Big Data (Big Data)

View full text Add to dashboard Cite

show abstract

“…However, the findings also highlight that some dimensions, such as communication expertise, selfawareness, and expert identification, might also be addressed through other methods, such as training and team development. Research to further explore this angle could better inform training, development, and retention strategies for incident responders [37].…”

Section: Dimensional Expertise In Lower Tier Irmentioning

confidence: 99%

“…However, this strategy is based on improving current operational stability. While the added SOAR capability offers some level of solution to immediate problems, the next steps of the field should progress towards long-term development of cyber security professionals [37,50], recognizing that the traditional path to becoming an expert in security has fundamentally changed due to the introduction of automation. Furthermore, system developers should consider the role of menial (but fundamental) tasks in analyst development, and the potential effects of system failure coupled with incomplete system understanding.…”

Section: Implications For Technology Developmentmentioning

confidence: 99%

Identifying Expertise Gaps in Cyber Incident Response: Cyber Defender Needs vs. Technological Development

Nyre-Yu¹

2021

Proceedings of the Annual Hawaii International Conference on System Sciences

Self Cite

View full text Add to dashboard Cite

Incident response is an area within cyber defense that is responsible for detecting, mitigating, and preventing threats within a given network. Like other areas of cyber security, incident response is experiencing a shortage of qualified workers which has led to technological development aimed at alleviating labor-related pressures on organizations. A cognitive task analysis was conducted with incident response experts to capture expertise requirements and used an existing construct to help prioritize development of new technology. Findings indicated that current software development incorporates factors such as analyst efficiency and consistency. Gaps were identified regarding communication and team navigation that are inherent to dynamic team environments. This research identified which expertise areas are needed at lower-tier levels of incident response and which of those areas current automation platforms are addressing. These gaps help focus future studies by bridging expertise research to development efforts.

show abstract

“…These overhead tasks can be characterized and mitigated or removed to increase process efficiency. Knowledge and information are critical to reasoning and code comprehension in RE tasks, but the act of searching for and retrieving that information is not adding value; as in other investigation-based cybersecurity settings [22], this makes knowledge & information gathering a good candidate for automation.…”

Section: Rq3: Automatable Tasksmentioning

confidence: 99%

A Task Analysis of Static Binary Reverse Engineering for Security.

Nyre-Yu¹,

Butler²,

Bolstad³

2021

Proposed for Presentation at the 55th Hawaii International Conference on Systems Science Held January 3-7, 2022 in Maui, Hi.

View full text Add to dashboard Cite

Software is ubiquitous in society, but understanding it, especially without access to source code, is both non-trivial and critical to security. A specialized group of cyber defenders conducts reverse engineering (RE) to analyze software. The expertise-driven process of software RE is not well understood, especially from the perspective of workflows and automated tools. We conducted a task analysis to explore the cognitive processes that analysts follow when using static techniques on binary code. Experienced analysts were asked to statically find a vulnerability in a small binary that could allow for unverified access to root privileges. Results show a highly iterative process with commonly used cognitive states across participants of varying expertise, but little standardization in process order and structure. A goal-centered analysis offers a different perspective about dominant RE states. We discuss implications about the nature of RE expertise and opportunities for new automation to assist analysts using static techniques.

show abstract

Informing Hybrid System Design in Cyber Security Incident Response

Cited by 6 publications

References 19 publications

Towards XAI in the SOC – a user centric study of explainable alerts with SHAP and LIME

Towards XAI in the SOC – a user centric study of explainable alerts with SHAP and LIME

Identifying Expertise Gaps in Cyber Incident Response: Cyber Defender Needs vs. Technological Development

A Task Analysis of Static Binary Reverse Engineering for Security.

Contact Info

Product

Resources

About