Accepted author manuscript, 163 KB, PDF document
Research output: Contribution to conference - Without ISBN/ISSN › Poster › peer-review
Research output: Contribution to conference - Without ISBN/ISSN › Poster › peer-review
}
TY - CONF
T1 - Citrus
T2 - 6TH IEEE/IFIP Workshop on Security for Emerging Distributed Network Technologies (Virtual)
AU - Mills, Ryan
AU - Broadbent, Matthew
AU - Race, Nicholas
N1 - Conference code: 6th
PY - 2020/4/24
Y1 - 2020/4/24
N2 - Despite the Internet being an apex of human achievement for many years, sophisticated targeted attacks are becoming more prevalent than ever before. Large scale data collection using threat sources such as honeypots have recently been employed to gather information relating to these attacks. While this data naturally details attack properties, there exists challenges in extracting the relevant information from vast data sets to provide valuable insight and a standard description of the attack.Traditionally, threats are identified through the use of signatures that are crafted manually through the composition of IOCs (Indicators of Compromise) extracted from telemetry captured during an attack process, which is often administered by an experienced engineer. These signatures have been proven effective in their use by IDSs (Intrusion Detection Systems) to detect emerging threats. However, little research has been made in automating the extraction of emerging IOCs and the generation of corresponding signatures which incorporate host artefacts.In this paper we present Citrus: a novel approach to the generation of signatures by incorporating host based telemetry extracted from honeypot endpoints. Leveraging this visibility at an endpoint grants a detailed understanding of bleeding edge attack tactics, techniques, and procedures gathered from host logs.
AB - Despite the Internet being an apex of human achievement for many years, sophisticated targeted attacks are becoming more prevalent than ever before. Large scale data collection using threat sources such as honeypots have recently been employed to gather information relating to these attacks. While this data naturally details attack properties, there exists challenges in extracting the relevant information from vast data sets to provide valuable insight and a standard description of the attack.Traditionally, threats are identified through the use of signatures that are crafted manually through the composition of IOCs (Indicators of Compromise) extracted from telemetry captured during an attack process, which is often administered by an experienced engineer. These signatures have been proven effective in their use by IDSs (Intrusion Detection Systems) to detect emerging threats. However, little research has been made in automating the extraction of emerging IOCs and the generation of corresponding signatures which incorporate host artefacts.In this paper we present Citrus: a novel approach to the generation of signatures by incorporating host based telemetry extracted from honeypot endpoints. Leveraging this visibility at an endpoint grants a detailed understanding of bleeding edge attack tactics, techniques, and procedures gathered from host logs.
U2 - https://doi.org/10.1109/NOMS47738.2020.9110443
DO - https://doi.org/10.1109/NOMS47738.2020.9110443
M3 - Poster
Y2 - 24 April 2020 through 24 April 2020
ER -