cyberaCTIve: a STIX-based Tool for Cyber Threat Intelligence in Complex Models

Czekster, Ricardo M.; Metere, Roberto; Morisset, Charles

doi:10.48550/arxiv.2204.03676

Cited by 1 publication

(4 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We base our contribution over STIX modelling, a popular ad-hoc notation for storing and sharing CTI across trustful counterparts. For this work, we have employed a tool based on STIX called cyberaCTIve [30], that offers two functionalities: a dashboard visualiser that is clear when managing complex models, as active buildings require, and a timed event list of model changes for basic forensic analysis. As active buildings are potential target of cyber-attacks that have serious repercussions to the power grid (a critical infrastructure), security officers would benefit from using IDS.…”

Section: Discussionmentioning

confidence: 99%

“…This allows for basic forensic analysis on the model, e.g., in our case the model of an active building. Unfortunately, cyberaCTIve [30] does not implement any automation for feeding the model with real-time incidents. So, we extended the tool to allow an external source of CTI to augment the STIX model (Observation: we shall release this extension as open-source in due course, adjusting it to include a link to it in the final version of this paper.).…”

Section: A Base Stix Model For Active Buildingsmentioning

confidence: 99%

“…This would clearly hinder timely interventions to real-time incursions. This is one of the reasons why we opted to use the tool cyberaCTIve [30].…”

Section: Appendix a Comparison To The Official Stix Visualisermentioning

confidence: 99%

“…To tame such complexity, we model a basic scenario to manage CTI in the context of active buildings. We used the tool cyberaCTIve [30] to create and manage our model. The model can be exported and it is fully compliant to the STIX format, so other tools can easily manipulate it.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Incorporating Cyber Threat Intelligence into Complex Cyber-Physical Systems: A STIX Model for Active Buildings

2022

Self Cite

View full text Add to dashboard Cite

Active buildings can be briefly described as smart buildings with distributed and renewable energy resources able to energise other premises in their neighbourhood. As their energy capacity is significant, they can provide ancillary services to the traditional power grid. As such, they can be a worthy target of cyber-attacks potentially more devastating than if targeting traditional smart buildings. Furthermore, to handshake energy transfers, they need additional communications that add up to their attack surface. In such a context, security analysis would benefit from collection of cyber threat intelligence (CTI). To facilitate the analysis, we provide a base active building model in STIX in the tool cyberaCTIve that handles complex models. Active buildings are expected to implement standard network security measures, such as intrusion-detection systems. However, to timely respond to incidents, real-time detection should promptly update CTI, as it would significantly speed up the understanding of the nature of incidents and, as such, allow for a more effective response. To fill this gap, we propose an extension to the tool cyberaCTIve with a web service able to accept (incursion) feeds in real-time and apply the necessary modifications to a STIX model of interest.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: A Base Stix Model For Active Buildingsmentioning

confidence: 99%

“…This would clearly hinder timely interventions to real-time incursions. This is one of the reasons why we opted to use the tool cyberaCTIve [30].…”

Section: Appendix a Comparison To The Official Stix Visualisermentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations