loading
Documents

Research.Publish.Connect.

Paper

Authors: Ian Herwono and Fadi Ali El-Moussa

Affiliation: BT, United Kingdom

ISBN: 978-989-758-282-0

Keyword(s): Cyber Security, Kill Chain, Security Events Monitoring, Attack Detection Plan, Automated Process.

Related Ontology Subjects/Areas/Topics: Internet Technology ; Intrusion Detection and Response ; Web Information Systems and Technologies

Abstract: Early detection of cyber threats is critical for proactive network defence and protection against data, financial and reputation loss that could be caused by large-scale security breach. Continuous monitoring and in-depth analysis of related system and network events are required to achieve the objective. However cyber threat hunting activities are both time-consuming and labour-intensive; the prospect of being able to automate them effectively is thus worth exploring. In this paper we introduce the prototype of our attack detection tool for automating the process of discovering and correlating security events towards early threat detection. Its main objective is to facilitate continuous event monitoring and to alert security analysts whenever a series of detected events and activities may indicate early stages of a cyber kill chain. The process automation will reduce the load of human analysts and spare them valuable time to investigate more sophisticated, unknown attacks. W e provide two use cases which describe the chain of tasks a security analyst would have to perform when investigating cyber incidents and trying to identify the systems targeted by potential attack. We then show how to create attack detection plans for those use cases and apply them on relevant datasets. We present the results produced by the tool and discuss our future work on context-aware classification of security events which aims to make the detection process more efficient. (More)

PDF ImageFull Text

Download
Sign In Guest: Register as new SciTePress user now for free.

Sign In SciTePress user: please login.

PDF ImageMy Papers

You are not signed in, therefore limits apply to your IP address 54.227.31.145

In the current month:
Recent papers: 100 available of 100 total
2+ years older papers: 200 available of 200 total

Paper citation in several formats:
Herwono I. and El-Moussa F. (2018). Automated Detection of the Early Stages of Cyber Kill Chain.In Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-282-0, pages 182-189. DOI: 10.5220/0006543301820189

@conference{icissp18,
author={Ian Herwono and Fadi Ali El-Moussa},
title={Automated Detection of the Early Stages of Cyber Kill Chain},
booktitle={Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2018},
pages={182-189},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006543301820189},
isbn={978-989-758-282-0},
}

TY - CONF

JO - Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Automated Detection of the Early Stages of Cyber Kill Chain
SN - 978-989-758-282-0
AU - Herwono I.
AU - El-Moussa F.
PY - 2018
SP - 182
EP - 189
DO - 10.5220/0006543301820189

Login or register to post comments.

Comments on this Paper: Be the first to review this paper.