Rethinking information sharing for threat intelligence
Rethinking information sharing for threat intelligence
复制标题
重新思考威胁情报的信息共享
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Laurent L. Njilla
中科院分区：
文献类型：
--
作者：
Aziz Mohaisen;Omar Al;Charles A. Kamhoua;K. Kwiat;Laurent L. Njilla
在过去的十年中，信息安全和威胁形势显著增长，使得单个防御者难以同时防御所有攻击。这需要引入信息共享，这是一种在信任社区中共享威胁指标以促进防御的范例。在文献中提出了指标的表示、交换和消费标准，尽管各种问题受到了破坏。在本文中，我们采取的立场，重新思考信息共享的可操作的情报，突出各种问题，值得进一步探讨。我们认为，信息共享可以受益于定义良好的使用模型，威胁模型，通过测量和强大的评分，充分理解和保护隐私和质量的指标和强大的机制，以避免搭便车行为的自私代理人的风险。我们呼吁利用数据和社区结构的差异性来优化共享设计和结构。
In the past decade, the information security and threat landscape has grown significantly making it difficult for a single defender to defend against all attacks at the same time. This called for introducing information sharing, a paradigm in which threat indicators are shared in a community of trust to facilitate defenses. Standards for representation, exchange, and consumption of indicators are proposed in the literature, although various issues are undermined. In this paper, we take the position of rethinking information sharing for actionable intelligence, by highlighting various issues that deserve further exploration. We argue that information sharing can benefit from well-defined use models, threat models, well-understood risk by measurement and robust scoring, well-understood and preserved privacy and quality of indicators and robust mechanism to avoid free riding behavior of selfish agents. We call for using the differential nature of data and community structures for optimizing sharing designs and structures.