Security Operations Center Research Articles

ОПЕРАЦІЙНИЙ ЦЕНТР БЕЗПЕКИ ЯК ПОСЛУГА НА ОСНОВІ SIEM

This study examines the Security Operations Center, which provides detection and analysis of cybersecurity, rapid response, and prevention of cyber attacks. Security Operations Center technologies are used to provide visibility and enable analysts to protect against attacks. The algorithm of presenting the topic «Security Center» during the teaching of the discipline «Security of programs and data» at the Volodymyr Vynnychenko Central Ukrainian State Pedagogical University is shown, namely the problems of implementation of event monitoring systems «Security information and event management», types of operational centers, methods of building internal operational security centers. Subject competencies are formed in students: to classify, identify and protect information processing facilities from unauthorized access and computer viruses, to develop individual access control and information protection systems. The process of implementing Security information and event management systems at the enterprise is shown, the main mechanisms of this system using a hierarchical model, the main tasks of the security operational center, the key parameters of the Security Operations Center (organizational model, performance of functions that go beyond the tasks, level of authority), basic rules of correlation. The commercial security operations center SOC as a Service is considered, which is designed to help work with a huge amount of information, real-time monitoring and response to attacks. During the laboratory classes, the students analyzed the companies that provide security operations center services (Information Systems Security Partners, Octave Cybersecurity, Infopulse, Omega Security Service) and studied the factors that affect companies when choosing the type Security Operations Center. Key words: Security Operations Center, SEIM-systems, cybersecurity, SOC as a Service.

CTI-SOC2M2 – The quest for mature, intelligence-driven security operations and incident response capabilities

Threats, cyber attacks, and security incidents pertain to organizations of all types. Everyday information security is essentially defined by the maturity of security operations and incident response capabilities. However, focusing on internal information only has proven insufficient in an ever-changing threat landscape. Cyber threat intelligence (CTI) and its sharing are deemed necessary to cope with advanced threats and strongly influence security capabilities. Therefore, in this work, we develop CTI-SOC2M2, a capability maturity model that uses the degree of CTI integration as a proxy for SOC service maturity. In the course, we examine existing maturity models in the domains of Security Operations Centers (SOCs), incident response, and CTI. In search of adequate maturity assessment, we show threat intelligence dependencies through applicable data formats. As the systematic development of maturity models demands, our mixed methodology approach contributes a new in-depth analysis of intelligence-driven security operations. The resulting CTI-SOC2M2 model contains CTI formats, SOC services and is complemented with an evaluation through expert interviews. A prototypical, tool-based implementation is aimed to document steps towards the model’s practical application.

A selective ensemble model for cognitive cybersecurity analysis

Dynamic data-driven vulnerability assessments face massive heterogeneous data contained in, and produced by SOCs (Security Operations Centres). Manual vulnerability assessment practices result in inaccurate data and induce complex analytical reasoning. Contemporary security repositories’ diversity, incompleteness and redundancy contribute to such security concerns. These issues are typical characteristics of public and manufacturer vulnerability reports, which exacerbate direct analysis to root out security deficiencies. Recent advances in machine learning techniques promise novel approaches to overcome these notorious diversity and incompleteness issues across massively increasing vulnerability reports corpora. Yet, these techniques themselves exhibit varying degrees of performance as a result of their diverse methods. We propose a cognitive cybersecurity approach that empowers human cognitive capital along two dimensions. We first resolve conflicting vulnerability reports and preprocess embedded security indicators into reliable data sets. Then, we use these data sets as a base for our proposed ensemble meta-classifier methods that fuse machine learning techniques to improve the predictive accuracy over individual machine learning algorithms. The application and implication of this methodology in the context of vulnerability analysis of computer systems are yet to unfold the full extent of its potential. The proposed cognitive security methodology in this paper is shown to improve performances when addressing the above-mentioned incompleteness and diversity issues across cybersecurity alert repositories. The experimental analysis conducted on actual cybersecurity data sources reveals interesting tradeoffs of our proposed selective ensemble methodology, to infer patterns of computer system vulnerabilities.

Blockade-detection-response based security operations dashboard design

Standardization of the security operations dashboard is essential for efficient operation of security operations center. It must be able to comprehensively express the business activities of the security operations center. It should be possible to easily explain all business activities of the security operations center. In this paper, a security operations dashboard design based on Blockade-Detection-Response (BDR) is proposed. The BDR based security operations dashboard design is intended to reduce the effort and time required for configuring a dashboard for VIPs, and contribute to the systematic security operations from the perspective of blockade, detection and response for everlasting cyber threats.

A Review on the Role of Modern SOC in Cybersecurity Operations

This paper will examine the position and mission of today’s Security Operation Center (SOC), as well as the numerous tools available to those interested in pursuing a career in cybersecurity operations. Defending against today’s threats necessitates a method that is formalized, organized, and disciplined. Professionals in a Security Operations Center (SOC) are commonly used by businesses. SOCs provide a wide variety of services, from monitoring and control to comprehensive threat solutions and hosted security, all of which can be tailored to suit the needs of individual customers.

Assessing MITRE ATT&CK Risk Using a Cyber-Security Culture Framework.

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) Framework provides a rich and actionable repository of adversarial tactics, techniques, and procedures. Its innovative approach has been broadly welcomed by both vendors and enterprise customers in the industry. Its usage extends from adversary emulation, red teaming, behavioral analytics development to a defensive gap and SOC (Security Operations Center) maturity assessment. While extensive research has been done on analyzing specific attacks or specific organizational culture and human behavior factors leading to such attacks, a holistic view on the association of both is currently missing. In this paper, we present our research results on associating a comprehensive set of organizational and individual culture factors (as described on our developed cyber-security culture framework) with security vulnerabilities mapped to specific adversary behavior and patterns utilizing the MITRE ATT&CK framework. Thus, exploiting MITRE ATT&CK’s possibilities towards a scientific direction that has not yet been explored: security assessment and defensive design, a step prior to its current application domain. The suggested cyber-security culture framework was originally designed to aim at critical infrastructures and, more specifically, the energy sector. Organizations of these domains exhibit a co-existence and strong interaction of the IT (Information Technology) and OT (Operational Technology) networks. As a result, we emphasize our scientific effort on the hybrid MITRE ATT&CK for Enterprise and ICS (Industrial Control Systems) model as a broader and more holistic approach. The results of our research can be utilized in an extensive set of applications, including the efficient organization of security procedures as well as enhancing security readiness evaluation results by providing more insights into imminent threats and security risks.

Internet-of-Forensic (IoF): A blockchain based digital forensics framework for IoT applications

Digital forensic in Internet-of-Thing (IoT) paradigm is critical due to its heterogeneity and lack of transparency of evidence processing. Moreover, cross-border legalization makes a hindrance in such process pertaining to the cloud forensic issues. This urges a forensic framework for IoT which provides distributed computing, decentralization, and transparency of forensic investigation of digital evidences in cross-border perspectives. To this end, we propose a framework for IoT forensics that addresses the above mentioned issues. The proposed solution called Internet-of-Forensics (IoF) considers a blockchain tailored IoT framework for digital forensics. It provides a transparent view of the investigation process that involves all the stakeholders (e.g., heterogeneous devices, and cloud service providers) in a single framework. It uses blockchain-based case chain to deal with the investigation process including chain-of-custody and evidence chain. Consensus is used for consortium to solve the problems of cross-border legalization. This is also beneficial for a transparent and ease of forensic reference. The programmable lattice-based cryptographic primitives produce reduced complexities. It shows benefits for power-aware devices and puts an add-on to the novelty of the presented idea. IoF is generic; hence, it can be used by autonomous security operation centers, cyber-forensic investigators and manually initiated evidences under chain-of-custody for man-made crimes. Security services are assured as required by the framework. IoF is experimented and compared with the other state-of-the-art frameworks. The outcomes and analysis prove the efficiency of IoF concerning complexity, time consumption, memory and CPU utilization, gas consumption, and energy analysis.

IMDoC: Identification of Malicious Domain Campaigns via DNS and Communicating Files

Cyber attacks have become more sophisticated and frequent over the years. Detecting the components operated during a cyber attack and relating them to a specific threat actor is one of the main challenges facing cyber security systems. Reliable detection of malicious components and identification of the threat actor is imperative to mitigate security issues by Security Operations Center (SOC) analysts. The Domain Name System (DNS) plays a significant role in most cyber attacks observed nowadays in that domains act as a Command and Control (C&C) in coordinated bot network attacks or impersonate legitimate websites in phishing attacks. Thus, DNS analysis has become a popular tool for malicious domain identification. In this collaborative research associating Ben-Gurion University and IBM, we develop a novel algorithm to detect malicious domains and relate them to a specific malware campaign in a large-scale real-data DNS traffic environment, dubbed Identification of Malicious Domain Campaigns (IMDoC) algorithm. Its novelty resides in developing a framework that combines the existence of communicating files for the observed domains and their DNS request patterns in a real production environment. The analysis was conducted on real data from Quad9 (9.9.9.9) DNS recursive resolvers combined with malicious communicating files extracted from VirusTotal, and confirms the strong performance of the algorithm on a real large-scale data production environment.

POTENTIAL DISGUISING ATTACK VECTORS ON SECURITY OPERATION CENTERS AND SIEM SYSTEMS

In this article we highlight several potential vectors of attacks that can be carried out on a monitoring capacities powered by SOC SIEM using its common features and misconfigurations. Widely spread problems like excessive amounts of false positive alerts or not absolutely accurate configuration of the correlation rules may lead to situation where an attacker is able to trigger an undesired state of the monitoring system. We’ve find three potential vectors for evasion the SIEM powered SOCs monitoring. The first vector grounds on mechanisms used to collect event data – log collectors: the malfunctioning SIEM state can be achieved with generating and submitting the bogus event data to the processing party like SIEM. Fake data flow may cause generation of mistaken alerts which can confuse the analytics stuff. The second vector employs some of the attacker’s knowledge about actual SIEM configuration – exploitation of correlation rule flaws. Taking into account the fact that correlation rules are mostly hand-written, they are prone to some logic flaws – certain detection rules may not be triggered by all of the malicious attack indicators. An attacker with knowledge about that feature may fulfill the unrecorded conditions and trick the SIEM to treat the attack flow as benign activity. The last researched vector is based on redundantly sensitive detection rules which produce a lot of false positive alarms but are not removed. An attacker may trigger the malfunctioning alarm continuously to distract the analytics stuff and perform its actions under the cover of noise. Those discussed vectors are derived from analysis of the actual SIEM installations and SOC processes used as best practices. We have no actual indicators that those attacks are carried out “in wild” at the moment of issuing of this article, but it is highly probable that those tactics may be used in the future. The purpose of this research is to highlight the possible risks for the security operation centers connected with actual processes and practices used in industry and to develop the remediation strategy in perspective.

Optical network security management: requirements, architecture, and efficient machine learning models for detection of evolving threats [Invited

As the communication infrastructure that sustains critical societal services, optical networks need to function in a secure and agile way. Thus, cognitive and automated security management functionalities are needed, fueled by the proliferating machine learning (ML) techniques and compatible with common network control entities and procedures. Automated management of optical network security requires advancements both in terms of the performance and efficiency of ML approaches for security diagnostics, as well as novel management architectures and functionalities. This paper tackles these challenges by proposing what we believe to be a novel functional block called the security operation center, describing its architecture, specifying key requirements on the supported functionalities, and providing guidelines on its integration with optical-layer controller. Moreover, to boost efficiency of ML-based security diagnostic techniques when processing high-dimensional optical performance monitoring data in the presence of previously unseen physical-layer attacks, we combine unsupervised and semi-supervised learning techniques with three different dimensionality reduction methods and analyze the resulting performance and trade-offs between the ML accuracy and run-time complexity.

Evaluation of Attackers’ Skill Levels in Multi-Stage Attacks

The rapid move to digitalization and usage of online information systems brings new and evolving threats that organizations must protect themselves from and respond to. Monitoring an organization’s network for malicious activity has become a standard practice together with event and log collection from network hosts. Security operation centers deal with a growing number of alerts raised by intrusion detection systems that process the collected data and monitor networks. The alerts must be processed so that the relevant stakeholders can make informed decisions when responding to situations. Correlation of alerts into more expressive intrusion scenarios is an important tool in reducing false-positive and noisy alerts. In this paper, we propose correlation rules for identifying multi-stage attacks. Another contribution of this paper is a methodology for inferring from an alert the values needed to evaluate the attack in terms of the attacker’s skill level. We present our results on the CSE-CIC-IDS2018 data set.

SOChain: A Privacy-Preserving DDoS Data Exchange Service Over SOC Consortium Blockchain

IoT devices provide a significant medium for distributed denial-of-service (DDoS) attacks. In 2016, a large-scale DDoS attack, named Dyn, caused massive damage to several well-known companies. One effective countermeasure is observing previous network traffic information or abnormal behavior determined by the host machines and determining the latest DDoS-attack IP addresses. Because of the lack of a fair exchange mechanism, most security operation centers (SOCs) are unwilling to share their real-time DDoS data. In this article, we propose a decentralized DDoS data exchange platform, namely SOChain, using blockchain technology to overcome the trust and fairness issues. The platform incentivizes SOCs through the DDoS_coin token. The more DDoS information an SOC contributes, the more coins it earns. To confirm the validity of uploaded information, we enlist a content verifier to examine uploaded abnormal IP addresses. Moreover, the verifier is incentivized by the DDoS_coin . To decrease the management effort, the entire flow is automatically executed in smart contract deployed onto the blockchain system. To address the issue of privacy in smart contracts, we devise a novel dual-level Bloom filter to enable efficient searches with privacy protection. Herein, a verifiable method is designed without revealing the information to public.

A User Centric Machine Learning Framework for Cyber Security Operation Center

In order to ensure a company's Internet security, SIEM (Security Information and Event Management) system is in place to simplify the various preventive technologies and flag alerts for security events. Inspectors (SOC) investigate warnings to determine if this is true or not. However, the number of warnings in general is wrong with the majority and is more than the ability of SCO to handle all awareness, because of this, malicious possibility. Attacks and compromised hosts may be wrong. Machine learning is a possible approach to improving the wrong positive rate and improving the productivity of SOC analysts. In this article, we create a user-centric engineer learning framework for the Internet Safety Functional Center in the real organizational context. We discuss regular data sources in SOC, their workflow, and how to process this data and create an effective machine learning system. This article is a immediate two groups of readers. The first group is intelligent researchers who have no knowledge of data scientists or computer safety fields but who engineer should develop machine learning Systems for machine safety. The second groups of visitors are Internet security practitioners that have deep knowledge and expertise in Cyber Security, but do Machine learning experiences do not exist and I'd like to create one by themselves. At the end of the paper, we use the account as an example to demonstrate full steps from data collection, label creation, feature engineering, machine learning algorithm and sample performance evaluations using the computer built in the SOC production of Seyondike

ФУНКЦІОНАЛЬНА МОДЕЛЬ ОПЕРАТИВНОГО ЦЕНТРУ КІБЕРЗАХИСТУ

The article considers the functional model of the Security Operation Center (SOC), which combines the basic policies, procedures and technological tools to combat cyber impacts on the organization. The main functions of SOC, tasks and methods of implementation are defined. Examples of practical application of the model are given. The architecture of a typical SOC infrastructure is proposed.

Processing tweets for cybersecurity threat awareness

Receiving timely and relevant security information is crucial for maintaining a high-security level on an IT infrastructure. This information can be extracted from Open Source Intelligence published daily by users, security organisations, and researchers. In particular, Twitter has become an information hub for obtaining cutting-edge information about many subjects, including cybersecurity. This work proposes SYNAPSE, a Twitter-based streaming threat monitor that generates a continuously updated summary of the threat landscape related to a monitored infrastructure. SYNAPSE is designed to accurately select any kind of cybersecurity events and summarise them for the convenience of security analysts. Its tweet-processing pipeline is composed of filtering, feature extraction, binary classification, an innovative clustering strategy, and generation of Indicators of Compromise (IoCs). A quantitative evaluation considering over 195.000 tweets from 80 accounts over more than 8 months, shows that our approach successfully finds the majority of security-related tweets concerning an example IT infrastructure (true positive rate above 90%), incorrectly selects a small number of tweets as relevant (false positive rate under 10%), and summarises the results in few IoCs per day. A qualitative evaluation of the IoCs generated by SYNAPSE demonstrates their relevance, and timeliness. Finally, we provide some highlights of a real-world integration of SYNAPSE with the Security Operation Center of a nation-wide electric utility.

A Review on Risk Assessment Using Risk Prediction Technique in Campus Network

Risk assessment is an important part of a risk management process to secure information systems. The risk assessment activities helped organizations determine the acceptable level of risk. Understanding and assessing risk is an important process to improve information security in making decisions. Risk prediction is an important part of information security system. In order to security operation center understand their environment, risk prediction technique helped them to create a holistic understanding of the networks, systems, services and applications they are responsible for monitoring. In this research paper, we discussed past related research in doing a risk prediction in conducting a risk assessment activity at the campus network. We have selected 5 key databases in computer science area. We have refined the searching based on subject area, types of document, publication title, index terms, sub-keyword and source title. In doing the screening process, we exclude articles that did not meet research selection criteria based on keyword searching in the papers. From the comprehensive literature search databases searching, we have selected 15 articles related to subject risk prediction conducted in campus network.

Clasificador de logs de acceso para detección de incidentes de ciberseguridad

The number of attacks on government websites has escalated in the last years. In order to assist in the detection process conducted by cybersecurity analysts, this document suggests implementing machine learning techniques over web server access logs. The overall objective is to optimize the detection time using a customized classifier which selects traces corresponding to anomalous activity. Specifically, web server combined log format (CLF) access logs coded as real vectors are an input to a weighted K-NN nearest neighbors’ model. The methodology was tested on datasets and premises provided by the CERTuy (National Cybersecurity Event Response Team) and the SOC (Security Operations Center). According to evaluations 82% of cybersecurity offenses have been detected, 80% of normal behavior has been filtered and the reduction time has been reduced from 13 hours to 15 minutes.

An Innovative Approach to Anomaly Detection in Communication Networks Using Multifractal Analysis

Fractal and multifractal analysis can help to discover the structure of the communication system, and in particular the pattern and characteristics of traffic, in order to understand the threats better and detect anomalies in network operation. The massive increase in the amount of data transmitted by different devices makes these systems the target of various types of attacks by cybercriminals. This article presents the use of fractal analysis in detecting threats and anomalies. The issues related to the construction and functioning of the Security Operations Centre (SOC) are presented. To examine the correctness of SOC, several attacks on virtual systems located in the network were carried out, such as Denial of Service (DoS) attack, brute force, malware infections, exploits. Based on data collected from monitoring and devices, the response to the event was analyzed, and multifractal spectra of network traffic before and during the incident were created. The collected information allows us to verify the theses and confirm the effectiveness of multifractal methods in detecting anomalies in the operation of any Information and Communication Technology (ICT) network. Such solutions will contribute to the development of advanced intrusion detection systems (IDS).

Two Can Play That Game

Cyber-security is an important societal concern. Cyber-attacks have increased in numbers as well as in the extent of damage caused in every attack. Large organizations operate a Cyber Security Operation Center (CSOC), which forms the first line of cyber-defense. The inspection of cyber-alerts is a critical part of CSOC operations (defender or blue team). Recent work proposed a reinforcement learning (RL) based approach for the defender’s decision-making to prevent the cyber-alert queue length from growing large and overwhelming the defender. In this article, we perform a red team (adversarial) evaluation of this approach. With the recent attacks on learning-based decision-making systems, it is even more important to test the limits of the defender’s RL approach. Toward that end, we learn several adversarial alert generation policies and the best response against them for various defender’s inspection policy. Surprisingly, we find the defender’s policies to be quite robust to the best response of the attacker. In order to explain this observation, we extend the earlier defender’s RL model to a game model with adversarial RL, and show that there exist defender policies that can be robust against any adversarial policy. We also derive a competitive baseline from the game theory model and compare it to the defender’s RL approach. However, when we go further to exploit the assumptions made in the Markov Decision Process (MDP) in the defender’s RL model, we discover an attacker policy that overwhelms the defender. We use a double oracle like approach to retrain the defender with episodes from this discovered attacker policy. This made the defender robust to the discovered attacker policy and no further harmful attacker policies were discovered. Overall, the adversarial RL and double oracle approach in RL are general techniques that are applicable to other RL usage in adversarial environments.

Security monitoring strategies for your OT infrastructure

Cyber security threats are an ever-increasing risk to industrial control systems (ICS). Therefore, by considering the impact of cyberattacks as part of improvements in operational technology (OT) infrastructure resiliency serves the ultimate goal of minimising production downtime. In order to achieve this, organisations should consider flexible and innovative security monitoring strategies as well as a security operations centre (SOC). Having security monitoring mechanisms and a SOC function benefits the OT infrastructure in multiple ways, including incident response management, threat and vulnerability management, asset inventory and management, network flow monitoring, security logs monitoring and correlation, as well as the core function of defence against cyberattacks. This paper demonstrates the best practices for security monitoring and protection used by different industry sectors and explains security monitoring tools and their special features, as well as how these monitoring tools are integrated within the SOC. The paper then illustrates the baseline design for building a SOC for OT infrastructure and what needs to be considered when implementing an OT SOC, including data onboarding from OT infrastructure, SOC use cases development, and other SOC functionalities such as vulnerability and risk management, malware detection and other features. The paper aims to benefit the OT security community by providing a general guidance, future vision and required information to build a functional security strategy for critical national infrastructure (CNI) by considering the security life cycle starting from monitoring, through detection, to response and reporting.