An Enhanced Cyber Attack Attribution Framework

Pitropakis, Nikolaos; Panaousis, Emmanouil; Giannakoulias, Alkiviadis; Kalpakis, George; Rodriguez, Rodrigo Diaz; Sarigiannidis, Panayiotis

Abstract

Advanced Persistent Threats (APTs) are considered as the threats that are the most challenging to detect and defend against. As APTs use sophisticated attack methods, cyber situational awareness and especially cyber attack attribution are necessary for the preservation of security of cyber infrastructures. Recent challenges faced by organizations in the light of APT proliferation are related to the: collection of APT knowledge; monitoring of APT activities; detection and classification of APTs; and correlation of all these to result in the attribution of the malicious parties that orchestrated an attack. We propose the Enhanced Cyber Attack Attribution (NEON) Framework, which performs attribution of malicious parties behind APT campaigns. NEON is designed to increase societal resiliency to APTs. NEON combines the following functionalities: (i) data collection from APT campaigns; (ii) collection of publicly available data from social media; (iii) honeypots and virtual personas; (iv) network and system behavioural monitoring; (v) incident detection and classification; (vi) network forensics; (vii) dynamic response based on game theory; and (viii) adversarial machine learning; all designed with privacy considerations in mind.

• Presentation Conference Type: Conference Paper (Published)
• Conference Name: International Conference on Trust and Privacy in Digital Business TrustBus 2018
• Start Date: Sep 5, 2018
• End Date: Sep 7, 2018
• Acceptance Date: May 24, 2018
• Online Publication Date: Jul 27, 2018
• Publication Date: 2018
• Deposit Date: Sep 21, 2018
• Electronic ISSN: 1611-3349
• Publisher: Springer
• Pages: 213-228
• Series Title: Lecture Notes in Computer Science
• Series Number: 11033
• Series ISSN: 0302-9743
• Book Title: Trust, Privacy and Security in Digital Business. TrustBus 2018
• ISBN: 9783319983844
• DOI: https://doi.org/10.1007/978-3-319-98385-1_15
• Keywords: Advanced Persistent Threats (APTs), cyber attack, Enhanced Cyber Attack Attribution (NEON) Framework,
• Public URL: http://researchrepository.napier.ac.uk/Output/1301025