Towards an Anonymity Supported Platform for Shared Cyber Threat Intelligence

Wagner, Thomas D.; Palomar, Esther; Mahbub, Khaled; Abdallah, Ali E.

doi:10.1007/978-3-319-76687-4_12

Cited by 5 publications

(4 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thomas D. Wagner et al (2018) analysed 30 threat sharing platforms with respect to anonymity. Their work focused on implementing and evaluating the anonymity prototype as a proof of concept for automating the processes involved in real time.…”

Section: Background and Literature Reviewmentioning

confidence: 99%

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

Shelke,

Hamalainen

2024

eccws

View full text Add to dashboard Cite

The escalating risk of cyber threats requires continuous advances in security monitoring techniques. This survey paper provides a comprehensive overview of recent research into novel methods for cyber threat detection, encompassing diverse approaches such as machine learning, artificial intelligence, behavioral analysis and anomaly detection. Machine learning plays a central role in cyber threat detection, highlighting the effectiveness of deep neural networks in identifying evolving threats. Their adaptability to changing attack patterns is emphasized, underlining their importance for real-time security monitoring. In parallel, ensemble learning is explored, combining multiple models to improve overall detection accuracy and create a robust defense against a spectrum of cyber threats. The literature reviewed highlights the importance of behavioral analysis, with a novel approach that integrates user behaviour profiling with anomaly detection. This has proven effective in identifying suspicious activity within a network, particularly insider threats and stealthy attacks. Another behavioral framework using User and Entity Behavior Analytics (UEBA) is presented for enhanced anomaly detection, highlighting the importance of context-aware monitoring in improving threat detection accuracy. Collaborative defense mechanisms emerge as a major focus of the research papers reviewed, exploring the potential of sharing threat information between organisations to enhance collective security monitoring. Their findings underscore the importance of a collaborative approach to staying ahead of rapidly evolving cyber threats. Some types of cyber-attacks are also analysed in the context of a security operations centre (SOC) monitoring environment using a security information and event management (SIEM) tool - Splunk. In conclusion, this survey paper synthesizes recent advances in cyber threat detection methods in security monitoring that integrate machine learning, behavioral analysis, and collaborative defense strategies. As cyber threats continue to evolve, these novel methods provide valuable insights for researchers, practitioners, and organisations seeking to strengthen their cybersecurity defenses. This concise overview emphasises the multi-dimensional approach required to secure digital ecosystems, providing a concise yet comprehensive guide to modern cyber threat detection strategies.

show abstract

Section: Background and Literature Reviewmentioning

confidence: 99%

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

Shelke,

Hamalainen

2024

eccws

View full text Add to dashboard Cite

show abstract

“…Since its inception within military circles, MISP has grown into one of the leading open-source sharing platforms used by over 6000 organizations worldwide 1 . MISP is also one of the most studied platforms [14], [15], [16], characterized as holistic and applicable in diverse scenarios as well as flexible considering the compatibility with different formats [11].…”

Section: Context and Related Workmentioning

confidence: 99%

A workflow and toolchain proposal for analyzing users’ perceptions in cyber threat intelligence sharing platforms

Stojkovski

Lenzini

2021

2021 IEEE International Conference on Cyber Security and Resilience (CSR)

View full text Add to dashboard Cite

Cyber Threat Intelligence (CTI) sharing platforms are valuable tools in cybersecurity. However, despite the fact that effective CTI exchange highly depends on human aspects, cyber behavior in CTI sharing platforms has been notably less investigated by the security research community.Motivated by this research gap, we ground our work in the concrete challenge of understanding users' perceptions of information sharing in CTI platforms. To this end, we propose a conceptual workflow and toolchain that would seek to verify whether users have an accurate comprehension of how far information travels when shared in a CTI sharing platform.We contextualize our concept within MISP as a use case, and discuss the benefits of our socio-technical approach as a potential tool for security analysis, simulation, or education/training support. We conclude with a brief outline of future work that would seek to evaluate and validate the proposed model.

show abstract

“…It also gives features where the intrusion and detecting techniques and humans can prove feedbacks irrespective of the size of information and the validity. This feedbacks are then distributed among the communities that follow peer-peer data exchange [11]. The section below provides a gist of relevant research carried out in the interoperability issues and data formats for the CTI interchange among different platforms.…”

Section: Related Workmentioning

confidence: 99%

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Alshehri¹

2021

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Cyber Threat Intelligence (CTI) has gained massive attention to collect hidden knowledge for a better understanding of the various cyber-attacks and eventually paving the way for predicting the future of such attacks. The information exchange and collaborative sharing through different platforms have a significant contribution towards a global solution. While CTI and the information exchange can help a lot in focusing and prioritizing on the use of the large volume of complex information among different organizations, there exists a great challenge ineffective processing of large count of different Indicators of Threat (IoT) which appear regularly, and that can be solved only through a collaborative approach. Collaborative approach and intelligence sharing have become the mandatory element in the entire world of processing the threats. In order to covet the complete needs of having a definite standard of information exchange, various initiatives have been taken in means of threat information sharing platforms like MISP and formats such as SITX. This paper proposes a scoring model to address information decay, which is shared within TISP. The scoring model is implemented, taking the use case of detecting the Threat Indicators in a phishing data network. The proposed method calculates the rate of decay of an attribute through which the early entries are removed.

show abstract

Towards an Anonymity Supported Platform for Shared Cyber Threat Intelligence

Cited by 5 publications

References 11 publications

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

A workflow and toolchain proposal for analyzing users’ perceptions in cyber threat intelligence sharing platforms

Generic Attribute Scoring for Information Decay in Threat Information Sharing Platform

Contact Info

Product

Resources

About