KRAKEN: A Knowledge-Based Recommender System for Analysts, to Kick Exploration up a Notch

Abstract

During a computer security investigation, a security analyst has to explore the logs available to understand what happened in the compromised system. For such tasks, visual analysis tools have been developed to help with log exploration. They provide visualisations of aggregated logs, and help navigate data efficiently. However, even using visualisation tools, the task can still be difficult and tiresome. The amount and the numerous dimensions of the logs to analyse, the potential stealthiness and complexity of the attack may end with the analyst missing some parts of an attack. We offer to help the analyst finding the logs where her expertise is needed rapidly and efficiently. We design a recommender system called KRAKEN that links knowledge coming from advanced attack descriptions into a visual analysis tool to suggest exploration paths. KRAKEN confronts real world adversary knowledge with the investigated logs to dynamically provide relevant parts of the dataset to explore. To evaluate KRAKEN we conducted a user study with seven security analysts. Using our system, they investigated a dataset from the DARPA containing different Advanced Persistent Threat attacks. The results and comments of the security analysts show the usability and usefulness of the recommender system.

Metagenomics Analysis of Breast Cancer to Study Bacterial Diversity

“…Kraken 2 29 tool was used for taxonomic analysis of all samples and bacterial community along with their abundance was predicted. Further Convert Kraken 30 tool was used to convert taxonomic file generated from Kraken 2 tool into Krona compatible file so that it can be used in Krona tool 31 for visualization of bacterial diversity in all the sample files taken into consideration. Figure 1 shows the steps and tools used for metagenomics analysis.…”

Hybrid knowledge-infused collaborative filtering for enhanced movie clustering and recommendation

“…By incorporating knowledge about learning styles and semantic web rules, their system can provide tailored recommendations that cater to individual learners' preferences and needs. KRAKEN, a knowledge-based recommender system created for security analysts, was introduced by Brisse, Boche, Majorczyk, and Lalande in 2022 (Brisse, Boche, Majorczyk, & Lalande, 2022). Their work highlights the value of knowledge-based strategies in assisting data exploration and decision-making processes.…”

The Attacker Might Also Do Next: ATT&CK Behavior Forecasting by Attacker-based Collaborative Filtering and Graph Databases

“…Studies [22] and [23] use ATT&CK data for collaborative filtering, with the aim of assisting SOC analysts in their analysis. Elitzur et al [22] proposed an approach to improve analysts' hypotheses about ongoing attacks by using a recommendation algorithm on the Cyber Threat Intelligence (CTI) graph and the ATT&CK knowledge graph.…”

“…However, since the analyst-created hypotheses are used as input for the recommendations, the results may be affected by the analyst's skill in creating the hypotheses. Brisse et al [23] have developed a visualization system based on knowledge-based recommendations called KRAKEN. They intended to add function to a tool called ZeroKit [24] that enables analysts to visualize data during log analysis and incident response.…”