Can Cybersecurity Be Proactive? A Big Data Approach and Challenges

Abstract

The cybersecurity community typically reacts to attacks after they occur. Being reactive is costly and can be fatal where attacks threaten lives, important data, or mission success. But can cybersecurity be done proactively? Our research capitalizes on the Germination Period-the time lag between hacker communities discussing software flaw types and flaws actually being exploited-where proactive measures can be taken. We argue for a novel proactive approach, utilizing big data, for (I) identifying potential attacks before they come to fruition; and based on this identification, (II) developing preventive countermeasures. The big data approach resulted in our vision of the Proactive Cybersecurity System (PCS), a layered, modular service platform that applies big data collection and processing tools to a wide variety of unstructured data sources to predict vulnerabilities and develop countermeasures. Our exploratory study is the first to show the promise of this novel proactive approach and illuminates challenges that need to be addressed.

Discovering New Cyber Protection Approaches from a Security Professional Prospective

“…In 2016, a US legislation was introduced to promote information sharing and emphasizing on new standards to facilitate such endeavors via the NST, the U.S. National Institute of Standards and Technology. According to the Compound Annual Growth Rate (CGR), Cybersecurity attacks are on the rise and incredibly from 66% every year since 2009 [20].With vulnerabilities that are designed flawed along with defects, hackers are able to infiltrate network and gain access to data and are able to control critical systems and proliferate denial of service.…”

Looking Beyond the Horizon

“…This contribution is an additional example of how proactive security allows for a faster response against abuse. Finally, the work by Bui [2] comes closest to our proposal. The authors argued that cybersecurity can capitalize on the Germination Period, which is "the time lag between hacker communities discussing software flaw types and flaws actually being exploited" Bui [2].…”

“…Finally, the work by Bui [2] comes closest to our proposal. The authors argued that cybersecurity can capitalize on the Germination Period, which is "the time lag between hacker communities discussing software flaw types and flaws actually being exploited" Bui [2]. They consequently proposed to crawl hacker forums for 0-days and vulnerabilities to feed a proactive security system.…”

Using Ontologies in Cybersecurity Field

“…They also identify two main categories of data sources available online that can contain data which suits the model proposed in this paper: hacker communities and public security databases. Several studies such as [7] [8] show that hacker communities need information and (continuously) share information among themselves in order to be effective. The collaboration between black hat hackers is based on subtle and indirect ways of work and discussing, presented in [3].…”

“…Germination period can be explained as "the time lag between hacker communities discussing software flaw types and flaws actually being exploited". [7] Its length depends on the difficulty of exploiting the vulnerabilities and the hackers' interest in it. This is the time when proactive measures can be taken.…”