Privacy Preserving Cyber Threat Information Sharing and Learning for Cyber Defense

Abstract

To secure cyber infrastructure against intentional and potentially malicious threats, a growing collaborative effort between cybersecurity professionals and researchers from institutions, private industries, academia, and government agencies has engaged in exploiting and designing a variety of cyber defense systems. Cybersecurity researchers and designers aim to maintain the confidentiality, integrity, and availability of information and information management systems through various cyber defense systems that protect computers and networks from hackers who may want to steal financial, medical, or other identity-based information. The Cooperative Cyber-defense has been recognized as an essential strategy to fight against cyberattacks. Cyber-security information sharing among various organizations and leveraging the aggregated cyber information to build proactive cyber defense system is nontrivial for organizations. However, building such cyber defense system is challenged by two issues: (1) organizations are reluctant to share their private information to others (2) even when they agree on a solution where information can be shared in privacy preserving manner, the obfuscated cyber threat information has to be processed to build the trained model for future prediction of any new or unknown cyber incident. To address these issues, in this paper, we propose a privacy preserving protocol where organizations can share their private information as an encrypted form with others and they can learn the information for future prediction without disclosing any private information. More specifically we propose a privacy preserving decision tree algorithm, where each organization can build and learn the decision tree based on overall organizations’ training spam/ham email data without disclosing any private information of any party. Once the building of a decision tree is done, the organizations can predict if any new email is spam or ham locally.