Home > Research > Publications & Outputs > Citrus

Electronic data

Text available via DOI:

View graph of relations

Citrus: Orchestrating Security Mechanisms via Adversarial Deception

Research output: Contribution to conference - Without ISBN/ISSN Posterpeer-review

Publication date24/04/2020
Number of pages4
<mark>Original language</mark>English
Event6TH IEEE/IFIP Workshop on Security for Emerging Distributed Network Technologies (Virtual) - Budapest, Hungary
Duration: 24/04/202024/04/2020
Conference number: 6th


Conference6TH IEEE/IFIP Workshop on Security for Emerging Distributed Network Technologies (Virtual)
Abbreviated titleDISSECT 2020
Internet address


Despite the Internet being an apex of human achievement for many years, sophisticated targeted attacks are becoming more prevalent than ever before.
Large scale data collection using threat sources such as honeypots have recently been employed to gather information relating to these attacks. While this data naturally details attack properties, there exists challenges in extracting the relevant information from vast data sets to provide valuable insight and a standard description of the attack.
Traditionally, threats are identified through the use of signatures that are crafted manually through the composition of IOCs (Indicators of Compromise) extracted from telemetry captured during an attack process, which is often administered by an experienced engineer. These signatures have been proven effective in their use by IDSs (Intrusion Detection Systems) to detect emerging threats. However, little research has been made in automating the extraction of emerging IOCs and the generation of corresponding signatures which incorporate host artefacts.
In this paper we present Citrus: a novel approach to the generation of signatures by incorporating host based telemetry extracted from honeypot endpoints. Leveraging this visibility at an endpoint grants a detailed understanding of bleeding edge attack tactics, techniques, and procedures gathered from host logs.