Intelligence Sharing Research Articles

Revealing and Sharing Malware Profile Using Malware Threat Intelligence Platform

Cyber Security is an interchange between attackers and defenders, a non-static balancing force. The increasing trend of novel security threats and security incidents, which does not seem to be stopping, prompts the need to add another line of security defences. This is because the risk management and risk detection has become virtually impossible due to the limited access towards user data and the variations of modern threat taxonomies. The traditional strategy of self-discovery and signature detection which has a static nature is now obsolete in facing threats of the new generation with a dynamic nature; threats which are resilient, complex, and evasive. Therefore, this thesis discusses the use of MISP and The Triad Investigation approach to share the Indicator of Compromise on Cyber Intelligence Sharing Platform to be able to address the newt threats.

A Theoretical review on the importance of Threat Intelligence Sharing & The challenges intricated

Cyber Threat Intelligence (CTI) is the emerging strategy of cyber defense which helps organizations to combat the latest and more sophisticated cyber threats. Gathering this threat information, analyzing and communicating it between the security teams is very difficult and challenging because of the heterogeneous aspects involved. The necessity of sharing the intelligence related data collected by organizations is increasing day by day to counter the ever changing and highly dynamic threat landscape. In this paper an attempt is made to understand CTI concept and how it is collected and analyzed to form useful actionable intelligence are observed. The importance of Threat intelligence sharing, and various standards working in the area of TIS are also mentioned. Finally the primary challenges in TIS are given a light in a broad view

Indian Ocean Geopolitics

The relevance of the IOR is fourfold, First historical relevance. The Indian Ocean has been a zone of human interaction for several millennia, boasting a 1,500 years history of active high seas trade -much before the arrival of Europeans in 1498. Adequate proofs exist to establish that the seafaring and maritime trade across these waters supplemented with facts of human migration, the spread of religion, visit of scholars, and many more since as early as the pre-historic era. Second, geographical relevance, it is said that in geopolitics, geography plays a vital role in influencing peace and security in the region. The Indian Ocean is the third largest Ocean having an area of 68.56 million sq km and covers about 20% of the earth's surface. It is nearly 10,000 km wide at the southern tips of Africa and Australia and extends nearly 13,500 km from the Persian Gulf to Antarctica. It is physically the most complex, walled ocean bounded on three sides by land. The Indian Ocean is not 'open-ended' like the Pacific or Atlantic. IOR stretches from the Suez Canal to the Strait of Malacca with its entry and exit constrained by choke points. Third, economic relevance, the IOR has 40 per cent of the world's energy reserves, 65 per cent of strategic raw material reserves and the largest producers of rubber, tea, spices and jute. It is also a region of extreme economic diversity and its natural resources add to its strategic significance. More than 65% of the world’s Uranium and oil reserves exist on the ocean bed. Last, the Strategic Relevance, Strategically, Indian Ocean is the most important water body of the world where global struggles will play out in the 21st century. The Indian Ocean is the focal point of all the major shipping routes of the world. Major sea routes passing through IOR connecting the Middle East, Africa, Europe and the Americas. The IOR is also the lifeline of international trade and economy, with half of the global cargo trade, two-third of the energy supplies and one-third of the bulk cargo trade passing through the Indian Ocean. Unlike the Pacific and Atlantic, 80% of the trade pattern is 'extra-regional'. About one Lakh ships pass through these waters in a year. According to an estimate, Indian Ocean shipping comprises the highest tonnage of goods in the world. Therefore, IOR needs effective maritime governance and maritime domain awareness by all littoral states. It needs soft power geopolitics practices together with regional integration – a strategic alliance. These can be achieved bridging through dialogues. Prospective military Alliances, Military Training Assistance, Military Diplomatic Exchanges and Defence industry and Technological Transfer are the realistic and appropriate defence integration that can be achieved for the unity of effort for a joint security mechanism. Integrated intelligence Sharing and Integrated Space and Cyber Security Organisations are the modern measures that can support the joint security strategies in the region. This paves the way to implement common cause missions for maintaining peace and order in the IOR.

Between Five Eyes: 50 Years of Intelligence Sharing by Anthony R. Wells. Havertown, PA: Casemate Publishers. 2020.

Between Five Eyes: 50 Years of Intelligence Sharing by Anthony R. Wells. Havertown, PA: Casemate Publishers. 2020.

Overview of Threat Intelligence Sharing and Exchange in Cybersecurity

Overview of Threat Intelligence Sharing and Exchange in Cybersecurity

A Summary of the Development of Cyber Security Threat Intelligence Sharing

In recent years, the sharing of cybersecurity threat intelligence (hereinafter referred to as threat intelligence) has received increasing attention from national network security management organizations and network security enterprises. Academia and industry have conducted research on threat intelligence analysis and sharing. This paper first introduces the value and significance of threat intelligence. Then it introduces the commonly used threat intelligence analysis model. Then it organizes and classifies the threat intelligence sharing norms and threat intelligence vendors. Then it starts from the main problems faced by threat intelligence sharing. A solution to build regional network security capabilities is presented; finally, the future research direction of threat intelligence sharing is explored.

Distributed Security Framework for Reliable Threat Intelligence Sharing

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Towards Intelligent Integration and Sharing of Stem Cell Research Data.

Advancements in regenerative medicine have brought to the fore the need for increased standardization and sharing of stem cell product characterization to help drive these innovative interventions toward public availability. Although numerous attempts have been made to store this data, there is still a lack of a platform that incorporates heterogeneous stem cell information into a harmonized project-based framework. The aim of this project was to introduce and pilot-test an intelligent informatics solution which integrates diverse stem cell product characteristics with study subject and omics information. In the resulting platform, heterogeneous data is validated using predefined ontologies and stored in a NoSQL repository. Pilot-testing was performed on nine sponsored stem cell projects conducting preclinical and intervention evaluations. The pilot-testing demonstrated the robustness of the proposed platform, by seamlessly harmonizing diverse common data elements, and the potential of this platform for driving knowledge generation from the aggregation of this shared data.

Intelligent Sharing for LTE and WiFi Systems in Unlicensed Bands: A Deep Reinforcement Learning Approach

Operating LTE networks in unlicensed bands together with legacy WiFi systems is deemed as a promising technique to support explosively growing mobile traffic. In conventional LTE/WiFi spectrum sharing schemes, LTE systems need to know WiFi traffic demands for optimizing system parameters to protect WiFi systems, for which the two systems are required to cooperate with each other via signallings exchanges. However, it is difficult to establish a dedicated channel among the two independent systems for exchanging signallings. Hence, in this paper, we propose an intelligent duty-cycle medium access control protocol to realize the effective and fair spectrum sharing between LTE and WiFi systems without requiring signalling exchanges. Specifically, we first design a duty-cycle spectrum sharing framework, which allows an LTE system to share the spectrum with a WiFi system by using time sharing. After that, we develop deep reinforcement learning (DRL)-based algorithms to learn WiFi traffic demands by analyzing WiFi channel activity, e.g., the idleness/business of WiFi channels, which can be observed by the LTE system via monitoring WiFi channels. Based on the learnt knowledge, the LTE system can adaptively optimize LTE transmission time to maximize its own throughput and meanwhile to provide sufficient protection to the WiFi system. Simulation results show that, in terms of LTE throughput and WiFi protection, the performance of the proposed intelligent scheme can approach that of the genie-aided exhaustive search algorithm, which needs the perfect knowledge of WiFi traffic demands through massive signalling exchanges and is of high computational complexity.

The Sum of All Friends: Improving Cross-border Intelligence Sharing in Europe - the Case of the Benelux

ABSTRACT In battling organized crime and terrorism, the sharing of intelligence is of crucial importance. This is especially true in Europe, where suspects can easily travel between the different ‘Schengen’ jurisdictions, which allows free movement of persons. It is crucial for EU member states to pool resources and share intelligence if they want to gain the upper hand in crime-fighting and counter-terrorism operations. Due to the highly sensitive nature of intelligence and the fact that being secretive is a tool of the trade, sharing does not come naturally to policing and intelligence agencies, especially not with foreign partners. However, there is a need to re-envision the relationships of these agencies with their foreign counterparts vis-à-vis intelligence sharing. This article will shed light on how cross-border intelligence sharing is currently undertaken by focusing on international police cooperation in the EU. By identifying the practices that have shaped the 2018 Benelux police cooperation treaty, this article will demonstrate how the EU can strengthen its intelligence-sharing mechanisms. In doing so, it aims to highlight the obstacles to overcome in order to level the playing field between criminals and terrorists on the one hand and policing and intelligence agencies on the other.

Intelligence Sharing: Networks, Teams and Ambiguity

This is the Introduction and first chapter for our new online book project, which is made public chapter by chapter as written (for free). The book is about behavioral economics, intelligence, espionage and decision-making under conditions of ambiguity. The first chapter is about basic decision theory, intelligence, espionage and the mirror-imaging problem.

Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme

Computer networks are facing threats of ever-increasing frequency and sophistication. Encryption is becoming the norm in both legitimate and malicious network traffic. Therefore, intrusion detection systems (IDSs) are now required to work efficiently regardless of the encryption. In this study, we propose two new methods to improve the efficacy of the Cisco Cognitive Threat Analytics (CTA) system. In the first method, the efficacy of CTA is improved by sharing of intelligence information across a large number of enterprise networks. In the second method, a four variant-based global reputation model (GRM) is designed by employing an outlier ensemble normalization algorithm in the presence of missing data. Intelligence sharing provides additional information in the intrusion detection process, which is much needed, particularly for analysis of encrypted traffic with inherently low information content. Robustness of the novel outlier ensemble normalization algorithm is also demonstrated. These improvements are measured using both encrypted and non-encrypted network traffic. Results show that the proposed information sharing methods greatly improve the anomaly detection efficacy of malicious network behavior with bad base-line detection efficacy and slightly improve upon the average case.

Research on University’s Cyber Threat Intelligence Sharing Platform Based on New Types of STIX and TAXII Standards

With the systematization of cyber threats, the variety of intrusion tools and intrusion methods has greatly reduced the cost of attackers’ threats to network security. Due to a large number of colleges and universities, teachers and students are highly educated and the Internet access rate is nearly 100%. The social status makes the university network become the main target of threat. The traditional defense method cannot cope with the current complex network attacks. In order to solve this problem, the threat intelligence sharing platform based on various threat intelligence sharing standards is established, which STIX and TAXII It is a widely used sharing standard in various sharing platforms. This paper analyzes the existing standards of STIX and TAXII, improves the STIX and TAXII standards based on the analysis results, and proposes a new type of STIX and TAXII based on the improved results. The standard design scheme of threat intelligence sharing platform suitable for college network environment features. The experimental results show that the threat intelligence sharing platform designed in this paper can be effectively applied to the network environment of colleges and universities.

“需求汇聚”智慧共享空间构建：基于数字云经济的理论视角

“需求汇聚”智慧共享空间构建：基于数字云经济的理论视角

Intelligence Sharing: The Challenges among the Nigerian Security Agencies and Government

Nigeria is a pluralistic society with diverse cultures and with the antecedent of criminal and insecurity activities. However, Nigeria’s government with a view to promoting national security has established many security outfits to cater for national security. For security to thrive in such situation there is need for intelligence sharing among these security agencies. Surprisingly, the multiple security outfits instead of achieving the utmost security among all odds have had to struggle with lack of cooperation, ego boosting, favouritism, and marginalisation. Individual outfit keeps its intelligence gathered within itself with a view to promoting unnecessary relevance and competition among other outfits rather than sharing intelligence to achieve common purpose. The study therefore examines the challenges of intelligence sharing among the Nigerian security agencies and the government that ought to execute intelligence report shared with it. Ironically, the politicisation of intelligence shared with government itself makes a mockery of intelligence sharing among the security outfits. The study also rests on observation and literature on intelligence and security highlighting the challenges of security outfits in Nigeria with their overlapping functions. The paper therefore recommends collaborative effort in intelligence sharing between the security agencies and government, depoliticising intelligence and more provision of security facilities to help gather information timely in order to forestall impending dangers.

Fighting for the Internet: Online Blackout Protests and Internet Legislation in the United States, 1996-2018

Fighting for the Internet: Online Blackout Protests and Internet Legislation in the United States, 1996-2018

Reaping the Rewards of Co-Operation. Franco-British Intelligence Sharing during the Gas War, 1915-1918

<em>Based on British and French archive material, this paper seeks to contribute to the limited “coalition warfare historiography” by exploring a neglected but revealing aspect of Franco-British chemical warfare between 1915-1918: Intelligence sharing. A contextual overview of the two allied intelligence services prior to and following the outbreak of war highlights their complementary strength and global reach. The tactical and strategic significance of French and British intelligence failures at the time of the first German poison gas attacks in April 1915 is examined and contrasted with subsequent allied experience. The discussion focuses upon the two most productive sources of allied intelligence information, mainly reports from secret agents and enemy prisoner of war interview digests. The volume, quality and detail of this material, and its importance to the Franco-British gas war effort are underlined. The article demonstrates how closely and effectively the two allies co-operated by exploiting their shared intelligence data to successfully anticipate German initiatives and to mitigate the searching battlefield challenge posed by an enemy whose technological superiority and resource advantages were evident especially during the earlier periods of the gas war on the Western Front.</em>

Data Swapping for Private Information Sharing of Web Search Logs

With the increasing number of sophisticated cyber attacks on both government and private infrastructure, cybersecurity data sharing is critical for the advancement of collaborative research among various entities, both in government, private sector, and academia. Of recent, the US Congress passed the Cyber Intelligence Sharing and Protection Act, as a framework for data sharing between various entities. Nevertheless this development raises the issue of trust between the collaborating parties, since shared data could be revealing. Conversely, due to the sensitive and confidential nature of the data involved, entities would have to employ various anonymization techniques to meet legal requirements in compliance with confidentiality policies of both their own organizations and federal government requirements. Secondly, a basic sharing of the data without the privatization process could make entities involved vulnerable to insider and inference attacks. For instance, an entity sharing data on cyber attacks might accidently reveal a sensitive network topology to an untrusted collaborator. As a contribution, we propose a modest but effective data privacy enhancement heuristic; a targeted 2k basic data swapping of individual web search log records. In this heuristic, if individual has a set of x records in their web search log set A, those records are swapped in that individual set A, then swapped again with another individual y records in set B. Our preliminary results show that data swapping is effective for big data and it would be demanding to trace the original issuer of the queries in a given large dataset of web search logs, thus providing some level of confidentiality.

U.S. Cyber Threat Intelligence Sharing Frameworks

Malicious actors in cyberspace are gaining increasingly sophisticated tools, techniques, and procedures that are outpacing security solutions. Organized criminals and state-sponsored groups now hav...

Intelligence Sharing and the Fight against Terrorism in the Eu: Lessons Learned from Europol

Ex-post investigations of major terrorist attacks in Europe have highlighted the contradiction between the seemingly free movement of terrorists across Europe and the lack of EU-wide intelligence sharing. In response, EU policymakers have repeatedly promised to improve intelligence sharing across Europe, and some have even floated the idea that Europol should be turned into a centralised EU criminal intelligence hub, akin to the US Federal Bureau of Investigation. In this article, I argue that despite the clear need for borderless intelligence sharing as a response to borderless terrorism, Europol is highly unlikely to become a genuine intelligence agency in the foreseeable future. Experience to date with Europol suggests that it is one thing for Europe's policymakers to make public promises to improve the fight against terrorism via better intelligence sharing across Europe, and quite another thing for them to persuade the relevant national agencies to comply.