Controlled Data Sharing for Collaborative Predictive Blacklisting

Abstract

Although sharing data across organizations is often advocated as a promising way to enhance cybersecurity, collaborative initiatives are rarely put into practice owing to confidentiality, trust, and liability challenges. In this paper, we investigate whether collaborative threat mitigation can be realized via a controlled data sharing approach, whereby organizations make informed decisions as to whether or not, and how much, to share. Using appropriate cryptographic tools, entities can estimate the benefits of collaboration and agree on what to share in a privacypreserving way, without having to disclose their datasets.We focus on collaborative predictive blacklisting, i.e., forecasting attack sources based on one's logs and those contributed by other organizations. We study the impact of different sharing strategies by experimenting on a realworld dataset of two billion suspicious IP addresses collected from Dshield over two months. We find that controlled data sharing yields up to 105% accuracy improvement on average, while also reducing the false positive rate.

Towards Predicting Cyber Attacks Using Information Exchange and Data Mining

“…Only a few works were found to approach the problem, although with rather simple approaches. For example, collaborative predictive blacklisting has been a subject of research [21,22] with promising results against specific attacks. However, a generic approach similar to early attempts to attack prediction is still an open research problem [3].…”

On collaborative predictive blacklisting

“…Toward this goal, we perform a set of measurements to shed light on (i) how to cluster We experiment with a few clustering algorithms using the number of common attacks as a measure of similarity, which can be computed in a privacy-preserving way, and experiment with privacy-friendly within-clusters sharing strategies, namely, only disclosing the details of common/correlated attacks. Overall, we show that our new hybrid model outperforms [9] in terms of hit counts (4x), while achieving better accuracy than [14] (2x).…”

“…We use this dataset both as training and testing sets -more precisely, we consider a sliding window of 5 days for training and 1 day for testing, as done in previous work [9,14].…”

“…First, we reproduce, measure, and compare the centralized (non-private) system by Soldo et al [14] vs the peer-to-peer privacy-friendly one by Freudiger et al [9], using alerts obtained from DShield.org, involving 70 organizations which report an average of 4,000 daily events over a 15-day time window. We finding that the former [14] achieves high hit counts (almost doubling correct predictions compared to no collaboration), but its F1 accuracy is ultimately poor (14%) due to high false positives.…”

“…In this paper, we present a measurement study of state-of-the-art CPB techniques, aiming to shed light on the actual impact of collaboration. To this end, we reproduce and measure two systems: a non privacy-friendly one that uses a trusted coordinating party with access to all alerts [14] and a peer-to-peer one using privacy-preserving data sharing [9]. We show that, while collaboration boosts the number of predicted attacks, it also yields high false positives, ultimately leading to poor accuracy.…”