Skip to main content

Research Repository

Advanced Search

Citrus: Orchestrating Security Mechanisms via Adversarial Deception

Mills, Ryan; Race, Nicholas; Broadbent, Matthew


Ryan Mills

Nicholas Race

Matthew Broadbent


Despite the Internet being an apex of human achievement for many years, malicious activity and cyber attacks are becoming more prevalent than ever before. Large scale data collection using threat sources such as honeypots have recently been employed to gather information relating to these attacks. While this data naturally details attack properties, there exists challenges in extracting the relevant information from vast data sets to provide valuable insight and a standard description of the attack. Traditionally, threats are identified through the use of signatures that are crafted manually through the composition of IOCs (Indicators of Compromise) extracted from telemetry captured during an attack process, which is often administered by an experienced engineer. These signatures have been proven effective in their use by IDSs (Intrusion Detection Systems) to detect emerging threats. However, little research has been made in automating the extraction of emerging IOCs and the generation of corresponding signatures which incorporate host artefacts. In this paper we present Citrus: a novel approach to the generation of signatures by incorporating host based telemetry extracted from honeypot endpoints. Leveraging this visibility at an endpoint grants a detailed understanding of bleeding edge attack tactics, techniques, and procedures gathered from host logs.

Presentation Conference Type Conference Paper (Published)
Conference Name NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium
Start Date Apr 20, 2020
End Date Apr 24, 2020
Online Publication Date Jun 8, 2020
Publication Date 2020
Deposit Date Mar 8, 2022
Publisher Institute of Electrical and Electronics Engineers
Series ISSN 2374-9709
Book Title NOMS 2020-2020 IEEE/IFIP Network Operations and Management Symposium
Public URL