SaTC: CORE: Small: Scalable and Meaningful Threat Intelligence Generation

SaTC：核心：小型：可扩展且有意义的威胁情报生成

• 批准号: 1717062
• 负责人: Damon McCoy
• 金额: $ 49.21万
• 依托单位: New York University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-15 至 2021-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1717062&HistoricalAwards=false
• 关键词: SaTC; CORE; Small; Scalable; Meaningful

Threat intelligence is used by organizations to protect systems and end-users by detecting and blocking communications with known attackers' systems. Quality threat intelligence can also provide methods of detecting attackers' tools, which are often less ephemeral than their attack infrastructure. Unfortunately, producing quality threat intelligence is often a highly manual and inefficient process. This has resulted in limited amounts of useful threat intelligence which is available only to those companies that can afford it. This research develops new data-analytics methods to identify an attacker's infrastructure and attack tools. Our methods leverage the ability to efficiently collect large amounts of raw attacker data, process it, and build artificial intelligence techniques to discover attack patterns. This project improves the efficiency of generating high quality threat intelligence data, and makes it more affordable to a large range of companies. Achieving this goal of improving the efficiency of generating useful threat intelligence requires progress on several key challenges. The project (i) investigates supervised machine learning based methods for efficiently collected large-scale amounts of data from attackers, (ii) improves methods for storing this data and other freely available raw threat intelligence data such that it can be easily joined, (iii) identifies robust features that can be extracted from this raw data which can be used for training supervised machine learning detection techniques, and (iv) enables high performance and efficient generation of large-scale useful threat intelligence data. Consequently, this research has the potential to transform the way in which threat intelligence data is produced and improve the security of organizations by making threat intelligence more accessible. This work also creates many educational opportunities for undergraduate and graduate students to gain experience using data-analytics techniques to efficiently detect emerging threats and improve the security of organizations.

威胁情报被组织用来通过检测和阻止与已知攻击者系统的通信来保护系统和最终用户。高质量的威胁情报还可以提供检测攻击者工具的方法，这些工具通常不像攻击基础设施那样短暂。不幸的是，生成高质量的威胁情报通常是一个高度手动且效率低下的过程。这导致只有那些负担得起的公司才能获得数量有限的有用威胁情报。这项研究开发了新的数据-分析方法来识别攻击者的基础设施和攻击工具。我们的方法能够有效地收集大量原始攻击者数据，对其进行处理，并构建人工智能技术来发现攻击模式。该项目提高了生成高质量威胁情报数据的效率，并使其更适合于大范围的公司。实现提高生成有用威胁情报的效率这一目标需要在几个关键挑战方面取得进展。该项目（i）研究基于监督机器学习的方法，以有效收集来自攻击者的大规模数据，（ii）改进存储这些数据和其他免费可用的原始威胁情报数据的方法，以便可以轻松地将其连接起来，（iii）识别可以从这些原始数据中提取的鲁棒特征，这些特征可以用于训练监督机器学习检测技术，以及（iv）能够高性能和高效地生成大规模有用的威胁情报数据。因此，这项研究有可能改变威胁情报数据的生成方式，并通过使威胁情报更容易获得来提高组织的安全性。这项工作还为本科生和研究生创造了许多教育机会，以获得使用数据分析技术的经验，从而有效地检测新兴威胁并提高组织的安全性。

项目成果

Clinical Computer Security for Victims of Intimate Partner Violence

亲密伴侣暴力受害者的临床计算机安全

• 发表时间: 2019
• 期刊: 28th USENIX Security Symposium
• 作者: Havron, Sam;Freed, Diana;Chatterjee, Rahul;McCoy, Damon;Dell, Nicola;Ristenpart, Thomas
• 通讯作者: Ristenpart, Thomas

A Security Analysis of the Facebook Ad Library

Facebook 广告库的安全分析

• DOI: 10.1109/sp40000.2020.00084
• 发表时间: 2020
• 期刊: 2020 IEEE Symposium on Security and Privacy (SP
• 作者: Edelson, Laura;Lauinger, Tobias;McCoy, Damon
• 通讯作者: McCoy, Damon

Platforms in Everything: Analyzing Ground-Truth Data on the Anatomy and Economics of Bullet-Proof Hosting

• 发表时间: 2019
• 作者: Arman Noroozian;J. Koenders;Eelco van Veldhuizen;C. Gañán;Sumayah A. Alrwais;Damon McCoy;M. V. Eeten

Schrödinger's RAT: Profiling the Stakeholders in the Remote Access Trojan Ecosystem

• 发表时间: 2018
• 作者: Mohammad Rezaeirad;Brown Farinholt;Hitesh Dharmdasani;P. Pearce;Kirill Levchenko;Damon McCoy

Reading the Tea leaves: A Comparative Analysis of Threat Intelligence

• 发表时间: 2019
• 期刊: 2020 IEEE International Conference on Big Data (Big Data)
• 作者: Vector Guo Li;M. Dunn;P. Pearce;Damon McCoy;G. Voelker;S. Savage