A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective

Abstract

IEEE Communications Surveys & Tutorials IEEE COMMUNICATIONS SURVEYS & TUTORIALS 2 followed by Detection & Analysis, Containment, Eradication & Recovery and concludes with Post-Incident Activity. It is worth mentioning that between the four phases feedback loops exist. Other incident handling process models (e.g., CERT/CC [24], ITIL [25], [26], [27]) are in line with the NIST incident response life cycle. Nevertheless, often incident response is narrowed down to only the Containment, Eradication & Recovery activities, whereas incident management and incident handling provide the larger reference framework [27], [21]. We follow this more precise approach and center on the pivotal activities of incident response. An elementary subarea in conjunction with incident response and its community is digital forensics. Digital forensics concerns data gathering and the detailed analysis of circumstances surrounding a security incident [26]. Within the NIST incident response life cycle, digital forensics mainly precedes the incident response action itself and can be attributed to Detection & Analysis. For our work, we separate between digital forensics and incident response and exclude the former. However, due to the nature of the analyzed data formats, there is at times overlap concerning investigative incident response activities. This situation leads to the focus of this survey described in Figure 2. The starting point of incident response and its standardization is hereby defined as trigger, alert, or event detected by an Intrusion Detection System (IDS), Security Information and Event Management (SIEM), or similar system, which then requires incident response actions. Also, CTI feeds, and structured threat reports are possible external starting points.

Network Interconnection Security Buffer Technology for Power Monitoring System

“…Frequent industrial control security incidents have attracted extensive attention from home and abroad. China and European and American countries have included the industrial control system in their national strategies [1][2][3].…”

Knowledge Management Strategy for Handling Cyber Attacks in E-Commerce with Computer Security Incident Response Team (CSIRT)

“…The term cyber relates to all aspects of computing, including storing data, protecting data, accessing data, processing data, transmitting data and connecting data. Also, cyber can defined as the space for data and information sharing towards the communities without the time and nation barrier [17].…”

PWNJUTSU: A Dataset and a Semantics-Driven Approach to Retrace Attack Campaigns

“…The reconstruction of this kind of attack is possible thanks to the collected logs exploitation. Then, in order to identify techniques performed by the attacker, we used a tool 9 that allows us to extract Events of Interest (EoI) [27] from the dataset. In the following, we detail actions performed by the participant #12, denoted P12.…”

“…As stated in [9], the Cyber Threat Intelligence experts need formalization at every stage of attacks to understand manipulated tools and data as well as to produce relevant, entirely usable, and comparable datasets.…”