Ryan Mills
Citrus: Orchestrating Security Mechanisms via Adversarial Deception
Mills, Ryan; Race, Nicholas; Broadbent, Matthew
Abstract
Despite the Internet being an apex of human achievement for many years, malicious activity and cyber attacks are becoming more prevalent than ever before. Large scale data collection using threat sources such as honeypots have recently been employed to gather information relating to these attacks. While this data naturally details attack properties, there exists challenges in extracting the relevant information from vast data sets to provide valuable insight and a standard description of the attack. Traditionally, threats are identified through the use of signatures that are crafted manually through the composition of IOCs (Indicators of Compromise) extracted from telemetry captured during an attack process, which is often administered by an experienced engineer. These signatures have been proven effective in their use by IDSs (Intrusion Detection Systems) to detect emerging threats. However, little research has been made in automating the extraction of emerging IOCs and the generation of corresponding signatures which incorporate host artefacts. In this paper we present Citrus: a novel approach to the generation of signatures by incorporating host based telemetry extracted from honeypot endpoints. Leveraging this visibility at an endpoint grants a detailed understanding of bleeding edge attack tactics, techniques, and procedures gathered from host logs.
Citation
Mills, R., Race, N., & Broadbent, M. (2020). Citrus: Orchestrating Security Mechanisms via Adversarial Deception. In NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium. https://doi.org/10.1109/NOMS47738.2020.9110443
Conference Name | NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium |
---|---|
Conference Location | Budapest, Hungary |
Start Date | Apr 20, 2020 |
End Date | Apr 24, 2020 |
Online Publication Date | Jun 8, 2020 |
Publication Date | 2020 |
Deposit Date | Mar 8, 2022 |
Publisher | Institute of Electrical and Electronics Engineers |
Series ISSN | 2374-9709 |
Book Title | NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium |
DOI | https://doi.org/10.1109/NOMS47738.2020.9110443 |
Public URL | http://researchrepository.napier.ac.uk/Output/2844089 |
You might also like
Practical Intrusion Detection of Emerging Threats
(2021)
Journal Article
Towards network-wide QoE fairness using openflow-assisted adaptive video streaming
(2013)
Conference Proceeding
“Sustainability... it’s just not important.”: The Challenges of Academic Engagement with Diverse Stakeholders
(2018)
Conference Proceeding
Using software defined networking to enhance the delivery of video-on-demand
(2015)
Journal Article