CRUSOE: A toolset for cyber situational awareness and decision support in incident handling

Husák, Martin; Sadlek, Lukas; Špaček, Stanislav; Laštovička, Martin; Javorník, Michal; Komárková, Jana

doi:10.1016/j.cose.2022.102609

Cited by 20 publications

(18 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In another example, Happa et al 71 conducted a user evaluation study of decision support tools for SOC analysts. A recent complex decision support system for cybersecurity incident handling proposed by Husák et al 2 also resorted to case study and user evaluation. These examples from the past two years illustrate the issues of evaluation of expert systems in cybersecurity caused by many specifics of this particular field of application.…”

Section: Discussionmentioning

confidence: 99%

“…In our recent work, 2 we presented a decision support component into the CRUSOE toolset, which aims to improve cyber situational awareness in incident handling. The CRUSOE toolset uses a continuous collection of data on the network and their visualization to guide a user through the procedures of incident handling and response.…”

Section: Related Workmentioning

confidence: 99%

“…The toolset is publicly available † , and the implemented algorithms were presented in another previous work 64 . Otherwise, our previous work presents only the basic ideas 64 and places particular tools into context 2 . In this article, we provide a detailed description of our approach in a generic context, not specifically for the incident handling support.…”

Section: Related Workmentioning

confidence: 99%

“…With the IT infrastructures growing larger and more complex, it becomes increasingly complicated to protect them, eliminate all their vulnerabilities, react to every new threat, and be prepared to face every possible attack scenario, especially with the scarce workforce in cybersecurity nowadays. Such circumstances create a need for automation and support in decision‐making 1,2 . Moreover, cybersecurity incident response teams and security operations centers (CSIRT/CERT/SOC) are not always aware of the priorities of the organization they protect.…”

Section: Introductionmentioning

confidence: 99%

“…For example, a security team may, in good faith, put an infected machine out of operation and, thus, unwillingly interrupt operations of a critical system or its dependency. Cybersecurity operators would benefit from systems that would increase their cyber situation awareness 2 . However, collaboration with other stakeholders in the organization is essential.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

Javorník

Husák

2022

Engineering Reports

Self Cite

View full text Add to dashboard Cite

We present an approach to decision support in cybersecurity with respect to cyber threats and stakeholders' requirements. We approach situations in which cybersecurity experts need to take actions to mitigate the risks, such as temporarily putting an IT system out of operation, but need to consult them with other stakeholders. We propose a decision support system that uses a mission decomposition model representing the organization's functional and security requirements on its IT infrastructure. Based on the cybersecurity state assessment, that is, discovery of vulnerabilities and attacker's position, the decision support system calculates the resilience metrics for each IT infrastructure's configuration, that is, how likely are they to not be disrupted. The calculation is enabled by two novel formal models, Privilege-Exploit Attack Graph and Bayesian Privilege Attack Graph, which reduce complex attack graphs into a comprehensible bipartite graph. Moreover, they illustrate the impact of exploiting the vulnerabilities and attackers gaining the privileges. The system recommends the most resilient mission configurations that are comprehensible to both cybersecurity experts and non-technical stakeholders, who may then choose which configuration to apply. Our approach is illustrated in a case study of a real-world medical information system.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

Javorník

Husák

2022

Engineering Reports

Self Cite

View full text Add to dashboard Cite

show abstract

Enhancing Security in Cloud Computing Using Artificial Intelligence ( AI )

Stutz,

de Assis,

Laghari

et al. 2024

Applying Artificial Intelligence in Cybersecurity Analytics and Cyber Threat Detection

View full text Add to dashboard Cite

On the Provision of Network-Wide Cyber Situational Awareness via Graph-Based Analytics

Husák,

Khoury,

Klisura

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we posit how semi-static (i.e., not changing very often) complex computer network-based intelligence using graph-based analytics can become enablers of Cyber Situational Awareness (CSA) (i.e., perception, comprehension, and projection of situations in a cyber environment). A plethora of newly surfaced cyber security researchers have used graph-based analytics to facilitate particular down tasks in dynamic complex cyber environments. This includes graph-, node- and edge-level detection, classification, and others (e.g., credit card fraudulent transactions as an edge classification problem). To the best of our knowledge, very limited efforts have consolidated the outputs of heterogeneous computer network monitoring and reconnaissance tools (e.g., Nmap) in enabling actionable CSA. As such, in this work, we address this literature gap while describing several use cases of graph traversal, graph measures, and subgraph mining in vulnerability and security state assessment, attack projection and mitigation, and device criticality estimation. We highlight the benefits of the graph-based approaches compared to traditional methods. Finally, we postulate open research and application challenges in graph-based analytics for CSA to prompt promising research directions and operational capabilities.

show abstract

CRUSOE: A toolset for cyber situational awareness and decision support in incident handling

Cited by 20 publications

References 19 publications

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

Mission‐centric decision support in cybersecurity via Bayesian Privilege Attack Graph

Enhancing Security in Cloud Computing Using Artificial Intelligence ( AI )

On the Provision of Network-Wide Cyber Situational Awareness via Graph-Based Analytics

Contact Info

Product

Resources

About