Cyber Threat Intelligence Research Articles

Cybersecurity Risk in U.S. Critical Infrastructure: An Analysis of Publicly Available U.S. Government Alerts and Advisories

As threat actor operations become increasingly sophisticated and emphasize the targeting of critical infrastructure and services, the need for cybersecurity information sharing will continue to grow. Escalating demand for cyber threat intelligence and information sharing across the cybersecurity community has resulted in the need to better understand the information produced by reputable sources such as U.S. CISA Alerts and ICS-CERT advisories. The text analysis program, Profiler Plus, is used to extract information from 1,574 U.S. government alerts and advisories to develop visualizations and generate enhanced insights into different cyber threat actor types, the tactics which can be used for cyber operations, and sectors of critical infrastructure at risk of an attack. The findings of this study enhance cyber threat intelligence activities by enabling an understanding of the trends in public information sharing as well as identifying gaps in open-source reporting on cyber-threat information.

Healthcare Security Incident Response Strategy - A Proactive Incident Response (IR) Procedure

The healthcare information system (HIS) has become a victim of cyberattacks. Traditional ways to handle cyber incidents in healthcare organizations follow a predefined incident response (IR) procedure. However, this procedure is usually reactive, missing the opportunities to foresee danger on the horizon. Cyber threat intelligence (CTI) contains information on emerging attacks and should be ideally utilized to inform the IR procedure. However, current research shows that the IR has not been effectively informed by CTI, especially in healthcare organizations. This paper fills in this gap by proposing a proactive IR response procedure based on the National Institute of Standards and Technology (NIST) IR methodology. This paper then presents the NHS WannaCry case study to demonstrate the use of the proposed IR methodology. We collate cyber security advisories from different CTI sources such as US/UK CERT to protect interconnected systems and devices from Ransomware attacks. This research provides novel insights into the IR in healthcare through embedding CTI advisories into IR processes and concludes that our proposed IR procedure can be used to counteract WannaCry Ransomware using CTI advisories. It has the significance of transforming the way of IR from reactive to proactive using the CTI in healthcare.

Towards a Hybrid Machine Learning Model for Intelligent Cyber Threat Identification in Smart City Environments

The concept of a smart city requires the integration of information and communication technologies and devices over a network for the better provision of services to citizens. As a result, the quality of living is improved by continuous analyses of data to improve service delivery by governments and other organizations. Due to the presence of extensive devices and data flow over networks, the probability of cyber attacks and intrusion detection has increased. The monitoring of this huge amount of data traffic is very difficult, though machine learning algorithms have huge potential to support this task. In this study, we compared different machine learning models used for cyber threat classification. Our comparison was focused on the analyzed cyber threats, algorithms, and performance of these models. We have identified that real-time classification, accuracy, and false-positive rates are still the major issues in the performance of existing models. Accordingly, we have proposed a hybrid deep learning (DL) model for cyber threat intelligence (CTI) to improve threat classification performance. Our model was based on a convolutional neural network (CNN) and quasi-recurrent neural network (QRNN). The use of QRNN not only resulted in improved accuracy but also enabled real-time classification. The model was tested on BoT-IoT and TON_IoT datasets, and the results showed that the proposed model outperformed the other models. Due to this improved performance, we emphasize that the application of this model in the real-time environment of a smart system network will help in reducing threats in a reasonable time.

HinCTI: A Cyber Threat Intelligence Modeling and Identification System Based on Heterogeneous Information Network

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">HinCTI</i> is developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. With <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">HinCTI</i> , comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

Key Requirements for the Detection and Sharing of Behavioral Indicators of Compromise

Cyber threat intelligence feeds the focus on atomic and computed indicators of compromise. These indicators are the main source of tactical cyber intelligence most organizations benefit from. They are expressed in machine-readable formats, and they are easily loaded into security devices in order to protect infrastructures. However, their usefulness is very limited, specially in terms of time of life. These indicators can be useful when dealing with non-advanced actors, but they are easily avoided by advanced ones. To detect advanced actor’s activities, an analyst must deal with behavioral indicators of compromise, which represent tactics, techniques and procedures that are not as common as the atomic and computed ones. In this paper, we analyze why these indicators are not widely used, and we identify key requirements for successful behavioral IOC detection, specification and sharing. We follow the intelligence cycle as the arranged sequence of steps for a defensive team to work, thereby providing a common reference for these teams to identify gaps in their capabilities.

Detecting User Behavior in Cyber Threat Intelligence: Development of Honeypsy System

This research demonstrates a design of an experiment of a hacker infiltrating a server where it is assumed that the communication between the hacker and the target server is established, and the hacker also escalated his rights on the server. Therefore, the honeypot server setup has been designed to reveal the correlation of a hacker’s actions with that of the hacker’s experience, personality, expertise, and psychology. To the best of our knowledge, such a design of experiment has never been tested rigorously on a honeypot implementation except for self-reporting tests applied to hackers in the literature. However, no study evaluates the actual data of these hackers and these tests. This study also provides a honeypot design to understand the personality and expertise of the hacker and displays the correlation of these data with the tests. Our Honeypsy system is composed of a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event to collect logs with honeypot applied in this sequence. These three steps generate data on the expertise and psychology of known cyber hackers. The logs of the known hacker activities on honeypots are obtained through the CTF event that they have participated in. The design and deployment of a honeypot, as well as the CTF event, were specifically prepared for this research. Our aim is to predict an unknown hacker's expertise and personality by analyzing these data. By examining/analyzing the data of the known hackers, it is now possible to make predictions about the expertise and personality of the unknown hackers. The same logic applies when one tries to predict the next move of the unknown hackers attacking the server. We have aimed to underline the details of the personalities and expertise of hackers and thus help the defense experts of victimized institutions to develop their cyber defense strategies in accordance with the modus operandi of the hackers.

Methodological Framework to Collect, Process, Analyze and Visualize Cyber Threat Intelligence Data

Cyber attacks have increased in frequency in recent years, affecting small, medium and large companies, creating an urgent need for tools capable of helping the mitigation of such threats. Thus, with the increasing number of cyber attacks, we have a large amount of threat data from heterogeneous sources that needs to be ingested, processed and analyzed in order to obtain useful insights for their mitigation. This study proposes a methodological framework to collect, organize, filter, share and visualize cyber-threat data to mitigate attacks and fix vulnerabilities, based on an eight-step cyber threat intelligence model with timeline visualization of threats information and analytic data insights. We developed a tool to address needs in which the cyber security analyst can insert threat data, analyze them and create a timeline to obtain insights and a better contextualization of a threat. Results show the facilitation of understanding the context in which the threats are inserted, rendering the mitigation of vulnerabilities more effective.

Robust Botnet DGA Detection: Blending XAI and OSINT for Cyber Threat Intelligence Sharing

We investigated 12 years DNS query logs of our campus network and identified phenomena of malicious botnet domain generation algorithm (DGA) traffic. DGA-based botnets are difficult to detect using cyber threat intelligence (CTI) systems based on blocklists. Artificial intelligence (AI)/machine learning (ML)-based CTI systems are required. This study (1) proposed a model to detect DGA-based traffic based on statistical features with datasets comprising 55 DGA families, (2) discussed how CTI can be expanded with computable CTI paradigm, and (3) described how to improve the explainability of the model outputs by blending explainable AI (XAI) and open-source intelligence (OSINT) for trust problems, an antidote for skepticism to the shared models and preventing automation bias. We define the XAI-OSINT blending as aggregations of OSINT for AI/ML model outcome validation. Experimental results show the effectiveness of our models (96.3&#x0025; accuracy). Our random forest model provides better robustness against three state-of-the-art DGA adversarial attacks (CharBot, DeepDGA, MaskDGA) compared with character-based deep learning models (Endgame, CMU, NYU, MIT). We demonstrate the sharing mechanism and confirm that the XAI-OSINT blending improves trust for CTI sharing as evidence to validate our proposed computable CTI paradigm to assist security analysts in security operations centers using an automated, explainable OSINT approach (for second opinion). Therefore, the computable CTI reduces manual intervention in critical cybersecurity decision-making.

Utilizing Cyber Threat Hunting Techniques to Find Ransomware Attacks: A Survey of the State of the Art

Ransomware is one of the most harmful types of cyber attacks that cause major concerns on a global scale. It makes the victims&#x2019; resources unusable by encrypting data or locking systems to extort ransom payments. Ransomware has variant families that continue to evolve. Moreover. cybercriminals use advanced techniques to develop ransomware, making it harder for anti-malware detection systems to detect them. Ransomware solutions need the capabilities of timely and effective detection and response to discover uncommon behavior before losing sensitive data. Cyber threat hunting (CTH) is a novel proactive malware detection approach that includes cyber threat intelligence (CTI) methods and data analysis methods. However, most present CTH solutions depend on internal data sources and reactive techniques to detect unusual activities. An effective CTI technique is required to obtain knowledge from external data sources and combine it with internal sources to enhance the hunting capabilities. Then, using the optimal data analysis technique is needed for the CTH approach to obtain valuable insights into abnormal patterns in running activities in the early stages. In this study, we investigate using a practical CTI approach and different CTH models. Subsequently, we discussed ransomware research directions to detect known and unknown ransomware attacks. Also, we discussed the available ransomware datasets used in present ransomware studies.

Multimodal Classification of Onion Services for Proactive Cyber Threat Intelligence Using Explainable Deep Learning

The dark web has been confronted with a significant increase in the number and variety of onion services of illegitimate and criminal intent. Anonymity, encryption, and the technical complexity of the Tor network are key challenges in detecting, disabling, and regulating such services. Instead of tracking an operational location, cyber threat intelligence can become more proactive by utilizing recent advances in Artificial Intelligence (AI) to detect and classify onion services based on the content, as well as provide an interpretation of the classification outcome. In this paper, we propose a novel multimodal classification approach based on explainable deep learning that classifies onion services based on the image and text content of each site. A Convolutional Neural Network with Gradient-weighted Class Activation Mapping (Grad-CAM) and a pre-trained word embedding with Bahdanau additive attention are the core capabilities of this approach that classify and contextualize the representative features of an onion service. We demonstrate the superior classification accuracy of this approach as well as the role of explainability in decision-making that collectively enables proactive cyber threat intelligence in the dark web.

Offensive Security: Cyber Threat Intelligence Enrichment With Counterintelligence and Counterattack

Cyber-attacks on financial institutions and corporations are on the rise, particularly during pandemics. These attacks are becoming more sophisticated. Reports of hacking activities against government and commercial sector organisations have garnered a lot of attention in the last several years. By design, the focus of Cyber Threat Intelligence (CTI) is exclusively defensive. This is because most of the CTI-derived analysis output is intended to prevent breaches or facilitate early detection. So, there is a need to have a new mechanism for unmasking the attacker. In this research, we demonstrate cyber threat intelligence enrichment with counterintelligence and counterattack combined with certain new methods to exploit the adversary’s vulnerability and fully control the attacker’s system. Attackers use a VPN to establish an anonymous connection. A VPN creates a secure “tunnelling” to the internet, with the VPN server acting as a middleman between the attacker and the web. This provides anonymity because the attacker’s IP address seems to be that of the VPN rather than his own, masking the IP address. So, hackers used this application to create persistence because it is automatically launched each time a computer is restarted. As a result, we are attempting to eliminate the persistence by removing it from the startup and registry. This research will help firms detect and identify an assault in its earliest phases, allowing them to respond accordingly. This project will develop new and innovative strategies to bypass VPNs and other security measures in order to obtain correct source information. Companies will be able to identify new methods by which their systems are penetrated and rapidly harden them. Using counterattack and counterintelligence, a proposed technique can bypass a VPN and get adversarial intel. The main goal of this research is to find the attacker’s footprints or tracks and find out why the attack was planned in the first place.

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

Open-source cyber threat intelligence (OSCTI) is becoming more influential in obtaining current network security information. Most studies on cyber threat intelligence (CTI) focus on automating the extraction of threat entities from public sources that describe attack events. The cybersecurity knowledge graph aims to change the expression of threat knowledge so that security researchers can accurately and efficiently obtain various types of threat information for preliminary intelligent decisions. The attribution technology can not only assist security analysts in detecting advanced persistent threats, but can also identify the same threat from different attack events. Therefore, it is important to trace the attack threat actor. In this study, we used the knowledge graph technology, considered the latest research on cyber threat attack attribution, and thoroughly examined key related technologies and theories in the process of constructing and applying the advanced persistent threat (APT) knowledge graph from OSCTI. We designed a cybersecurity platform named CSKG4APT based on a knowledge graph. Inspired by the theory of ontology, we constructed CSKG4APT as an APT knowledge graph model based on real APT attack scenarios. We then designed an APT threat knowledge extraction algorithm for completing and updating the knowledge graph using deep learning and expert knowledge. Finally, we proposed a practical APT attack attribution method with attribution and countermeasures. CSKG4APT is not a passive defense method in traditional network confrontation but one that integrates a large amount of fragmented intelligence and can actively adjust its defense strategy. It lays the foundation for further dominance in network attack and defense.

Enhancing Cyber Threat Intelligence Sharing through a Privacy-Preserving Federated Learning Approach

This paper proposes a privacy-preserving federated learning approach to enhance cyber threat intelligence sharing. Cyber threats are becoming more sophisticated and are posing serious security risks to organizations. Sharing threat intelligence information can help to detect and mitigate these threats quickly. However, privacy concerns and data protection regulations hinder the sharing of sensitive information. Federated learning is a promising approach that allows multiple parties to collaborate in building a global model while preserving data privacy. We propose a framework that utilizes federated learning to train a global threat intelligence model without compromising the privacy of individual organizations' data. Our approach also includes a differential privacy mechanism to ensure the anonymity of the participating organizations. We demonstrate the effectiveness of our approach through experiments conducted on real-world datasets, showing that it achieves high accuracy while maintaining data privacy. The proposed approach has the potential to facilitate more effective and secure cyber threat intelligence sharing among organizations.

HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles

The Internet of Vehicles (IoV), whereby interconnected vehicles that communicate with each other and with road infrastructure on a common network, has promising socio-economic benefits but also poses new cyber-physical threats. To protect these entities and learn about adversaries, data on attackers can be realistically gathered using decoy systems like honeypots. Admittedly, honeypots introduces a trade-off between the level of honeypot-attacker interactions and incurred overheads and costs for implementing and monitoring these systems. Deception through honeypots can be achieved by strategically configuring the honeypots to represent components of the IoV to engage attackers and collect cyber threat intelligence. Here, we present HoneyCar, a novel decision support framework for honeypot deception in IoV. HoneyCar benefits from the repository of known vulnerabilities of the autonomous and connected vehicles found in the Common Vulnerabilities and Exposure (CVE) database to compute optimal honeypot configuration strategies. The adversarial interaction is modelled as a repeated imperfect-information zero-sum game where the IoV network administrator strategically chooses a set of vulnerabilities to offer in a honeypot and a strategic attacker chooses a vulnerability to exploit under uncertainty. Our investigation examines two different versions of the game, with and without the re-configuration cost, to empower the network administrator to determine optimal honeypot investment strategies given a budget. We show the feasibility of this approach in a case study that consists of the vulnerabilities in autonomous and connected vehicles gathered from the CVE database and data extracted from the Common Vulnerability Scoring System (CVSS).

The Economics of Sharing Unclassified Cyber Threat Intelligence by Government Agencies and Departments

The Economics of Sharing Unclassified Cyber Threat Intelligence by Government Agencies and Departments

Cyber threat intelligence using PCA-DNN model to detect abnormal network behavior

Security issues are the most critical challenges facing new technologies associated with the internet of things (IoT), big data, and cloud computing. A secure and efficient intrusion detection system (IDS) is crucial to detect security threats. Existing IDSs are known to suffer from many problems, most notably the high rate of false positive alerts, the long time required to detect attacks, and the inability to detect zero-day attacks, which can ruin companies. The weakness of IDS backend engines costs companies time in the investigation process. This paper proposes and enhances IDS detection mechanisms via two processes: using a deep neural network (DNN) model with new features for threat detection based on two assumptions related to handling zero-day attacks, with low computing power and resources, and a comprehensive solution for detection by merging the DNN model and principle component analysis (PCA) to increase security and performance. The proposed detection mechanism combines DNN, PCA, statistical, and knowledge-based approaches to offer significantly greater efficiency than existing IDS, as indicated by analytical and software results. A simulation model is used with up-to-date web attacks, distributed denial of service (DDoS), denial of service (DoS), brute force, insider infiltration, Botnet, and Heartbleed attacks. The proposed detection techniques for large networks are analyzed and complexity in the design is avoided by reducing the number of DNN model layers, thus minimizing detection time delay and false positives, while increasing security against network attacks. Integrating the proposed DNN with PCA, an innovative contribution, introduces robust IDS to significantly improve the detection time delay and security performance. The proposed model showed a 98% accuracy rate. To best of our knowledge, the highest accuracy rate stated based on a large number of attacks is 97%, which makes our model state of art.

Threats from the Dark: A Review over Dark Web Investigation Research for Cyber Threat Intelligence

From proactive detection of cyberattacks to the identification of key actors, analyzing contents of the Dark Web plays a significant role in deterring cybercrimes and understanding criminal minds. Researching in the Dark Web proved to be an essential step in fighting cybercrime, whether with a standalone investigation of the Dark Web solely or an integrated one that includes contents from the Surface Web and the Deep Web. In this review, we probe recent studies in the field of analyzing Dark Web content for Cyber Threat Intelligence (CTI), introducing a comprehensive analysis of their techniques, methods, tools, approaches, and results, and discussing their possible limitations. In this review, we demonstrate the significance of studying the contents of different platforms on the Dark Web, leading new researchers through state-of-the-art methodologies. Furthermore, we discuss the technical challenges, ethical considerations, and future directions in the domain.

A Feature-driven Method for Automating the Assessment of OSINT Cyber Threat Sources

Global malware campaigns and large-scale data breaches show how everyday life can be impacted when the defensive measures fail to protect computer systems from cyber threats. Understanding the threat landscape and the adversaries’ attack tactics to perform it represent key factors for enabling an efficient defense against threats over the time. Of particular importance is the acquisition of timely and accurate information from threats intelligence sources available on the web which can provide additional intelligence on emerging threats even before they can be observed as actual attacks. Currently, specific indicators of compromise (e.g. IP addresses, domains, hashsums of malicious files) are shared in a semi-automated and structured way via so-called threat feeds. Unfortunately, current systems have to deal with the trade-off between the timeliness of such an alert (i.e. warning at the first mention of a threat) and the need to wait for verification by other sources (i.e. warning after multiple sources have verified the threat). In addition, due to the increasing number of open sources, it is challenging to find the right balance between feasibility and costs in order to identify a relatively small subset of valuable sources. In this paper, a method to automate the assessment of cyber threat intelligence sources and predict a relevance score for each source is proposed. Specifically, a model based on meta-data and word embedding is defined and experimented by training regression models to predict the relevance score of sources on Twitter. The results evaluation show that the assigned score allows to reduce the waiting time for intelligence verification, on the basis of its relevance, thus improving the time advantage of early threat detection.

Optimising cyber threat intelligence for your organisation

As the sophistication and capabilities of cyber threat actors increase, so does the need for cyber threat intelligence (CTI). Most organisations, however, do not have the resources for a large CTI team. Organisations can offset this disparity by optimising resources and focusing on what really matters. Even one CTI analyst can make a significant difference for an organisation by identifying business assets, aligning those assets to potential threats, and then working with cyber security components to prioritise detection and mitigation efforts. Getting to know the organisation and working with key stakeholders to build priority intelligence requirements will help a CTI team identify where to effectively focus its efforts. A small CTI team must also find force multipliers internal and external to the organisation, tailor deliverables and manage expectations. By following these guidelines, a CTI function will help move the cyber security posture of an organisation from reactive to proactive and gain an advantage over the adversary.

The Implementation of Strategic Threat Intelligence for Business Organization

Nowadays strategic threat intelligence is very important to all the organization. Strategic cyber threat intelligence can determine who and why to provide key insights to the organization. It purpose is to determine who is behind a particular threat or threat family and addressing to evolving trends. The strategic level of cyber threat intelligence also included and explains about why. Why makes a company or an organization a target? Strategic Threat Intelligence offer the overview of the threat status of the organization. Therefore, the C-Suite include chief executive officer (CEO), chief financial officer (CFO), chief operating officer (COO) and chief information officer (CIO) of the organization use cyber threat intelligence data to understand the high-level trends and threats to the company or the organization. The C-Suite of the organization also need to know how to implement the strategic threat intelligence to prevent unexpected things happen. This research paper aims to discuss about the importance of the strategic threat intelligence to the company or organization and how to implement it. After knowing and understanding the implementation of strategic threat intelligence to the company or organization, this research paper also will discuss about the when of using strategic threat intelligence. The issue and challenges is also discussed in the article.