Toward situational awareness in threat detection. A survey

Abstract

The pervasiveness of the Internet did not come without security risk. The current threat landscape is characterized by the rise of sophisticated cyber attacks, which target user devices and corporate infrastructure. To tackle the risk of compromise, data-driven detection strategies have become increasingly mainstream. The relevant literature includes many works that leverage opensource datasets, supervised learning or, less commonly, unsupervised learning. However, advanced network attacks' spatial and temporal characteristics prove standalone threat detection systems inadequate, especially for detecting a multi-stage attack and often stealthy techniques. Moreover, attackers have been demonstrating adversarial effects that are caused by deception and contaminating data-driven methods with adversarial learning. For these reasons, recent research in threat detection is moving away from commonly, and often obsolete, datasets as well as adopting more multi-layered decision strategies.As such, this article provides a comprehensive review of decision strategies. We also examine their ability to support cyber situational awareness (CSA), providing to security analysts CSA properties such as situation assessment and system refinement.

Situational Aware Access Control to Prevent Android Malware

“…The application of situational awareness in intrusion detection systems involved continuous monitoring of network traffic and user activities, enabling the identification of anomalous behaviors that may indicate security breaches [19]. Adaptive security frameworks, leveraging situational awareness, provided a more resilient defense by continuously evaluating and updating threat models based on the latest contextual information [20]. Cyber-physical systems benefited from situational awareness by integrating data from various sensors and sources, enabling a holistic understanding of the security landscape [21,22].…”

Building Situational Awareness of GDPR

“…They (Rajamäki & Katos, 2019) also observed data analytics techniques (e.g., clustering and classification) promoting SA, when integrated as a part of the information sharing system. Rendall et al (2021) used a survey to examine cyber threat detection SA. Panagiotis et al (2019) noticed that Internet of Things (IoT) applications creation requires advanced knowledge extraction and real time situations.…”