Automated Detection of the Early Stages of Cyber Kill Chain

Ian Herwono, Fadi Ali El-Moussa

2018

Abstract

Early detection of cyber threats is critical for proactive network defence and protection against data, financial and reputation loss that could be caused by large-scale security breach. Continuous monitoring and in-depth analysis of related system and network events are required to achieve the objective. However cyber threat hunting activities are both time-consuming and labour-intensive; the prospect of being able to automate them effectively is thus worth exploring. In this paper we introduce the prototype of our attack detection tool for automating the process of discovering and correlating security events towards early threat detection. Its main objective is to facilitate continuous event monitoring and to alert security analysts whenever a series of detected events and activities may indicate early stages of a cyber kill chain. The process automation will reduce the load of human analysts and spare them valuable time to investigate more sophisticated, unknown attacks. We provide two use cases which describe the chain of tasks a security analyst would have to perform when investigating cyber incidents and trying to identify the systems targeted by potential attack. We then show how to create attack detection plans for those use cases and apply them on relevant datasets. We present the results produced by the tool and discuss our future work on context-aware classification of security events which aims to make the detection process more efficient.

Paper Citation

in Harvard Style

Herwono I. and El-Moussa F. (2018). Automated Detection of the Early Stages of Cyber Kill Chain.In Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-282-0, pages 182-189. DOI: 10.5220/0006543301820189

in Bibtex Style

@conference{icissp18,
author={Ian Herwono and Fadi Ali El-Moussa},
title={Automated Detection of the Early Stages of Cyber Kill Chain},
booktitle={Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},
year={2018},
pages={182-189},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0006543301820189},
isbn={978-989-758-282-0},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 4th International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Automated Detection of the Early Stages of Cyber Kill Chain
SN - 978-989-758-282-0
AU - Herwono I.
AU - El-Moussa F.
PY - 2018
SP - 182
EP - 189
DO - 10.5220/0006543301820189