CyTIME: Cyber Threat Intelligence ManagEment framework for automatically generating security rules
CyTIME: Cyber Threat Intelligence ManagEment framework for automatically generating security rules
复制标题
CyTIME：用于自动生成安全规则的网络威胁情报管理框架
DOI：
10.1145/3226052.3226056
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Hyoungshick Kim
中科院分区：
文献类型：
--
作者：
Eunsoo Kim;Kuyju Kim;Dongsoon Shin;Beomjin Jin;Hyoungshick Kim
组织越来越有必要建立一个网络威胁情报（CTI）平台来对抗复杂的攻击。为了降低网络攻击的风险，安全管理员和/或分析师可以使用CTI平台来汇总有关对手、目标和漏洞的相关威胁信息，对其进行分析，并与合作者分享分析的关键观察结果。本文介绍了网络威胁情报管理框架CyTIME (Cyber Threat Intelligence ManagEment framework)，这是一个管理CTI数据的框架。CyTIME可以通过TAXII （Trusted Automated Exchange of Indicator Information）等标准接口定期从外部CTI数据存储库收集CTI数据。此外，CyTIME旨在自动生成安全规则，无需人工干预，以实时缓解发现的新网络安全威胁。为了证明CyTIME的可行性，我们进行了实验来测量完成生成与给定CTI数据对应的安全规则的任务所需的时间。我们使用了1000个与网络攻击相关的CTI文件。实验结果表明，CyTIME自动生成安全规则并存储到内部数据库的平均时间为12.941秒（max = 13.952，标准差= 0.580）。
It is becoming increasingly necessary for organizations to build a Cyber Threat Intelligence (CTI) platform to fight against sophisticated attacks. To reduce the risk of cyber attacks, security administrators and/or analysts can use a CTI platform to aggregate relevant threat information about adversaries, targets and vulnerabilities, analyze it and share key observations from the analysis with collaborators. In this paper, we introduce CyTIME (Cyber Threat Intelligence ManagEment framework) which is a framework for managing CTI data. CyTIME can periodically collect CTI data from external CTI data repositories via standard interfaces such as Trusted Automated Exchange of Indicator Information (TAXII). In addition, CyTIME is designed to automatically generate security rules without human intervention to mitigate discovered new cybersecurity threats in real time. To show the feasibility of CyTIME, we performed experiments to measure the time to complete the task of generating the security rule corresponding to a given CTI data. We used 1,000 different CTI files related to network attacks. Our experiment results demonstrate that CyTIME automatically generates security rules and store them into the internal database within 12.941 seconds on average (max = 13.952, standard deviation = 0.580).