CRII: SaTC: RUI: An Intelligent Data-Driven Framework to Achieve Proactive Cybersecurity

网络攻击部署的信息越来越多地被黑客在暗网的地下世界共享。在这些隐藏和匿名的环境中，网络犯罪分子讨论如何1)识别软件漏洞，2)创建或购买漏洞，3)选择目标并招募合作者，4)获得所需基础设施的访问权限，以及5)计划和执行攻击。尽管这种行为有助于黑客产生大量恶意软件，但它也为防御者提供了宝贵的情报，因为在线共享的信息可以作为各种网络威胁的前兆。本项目依托于前瞻性的网络威胁情报分析，解决了以下关键研究问题：能否准确预测新出现的网络威胁？通过对黑客通信的持续检索和分析，本研究将揭示恶意黑客的资产、能力、行为和兴趣，这些可以用于建立网络威胁预测。为了实现这一目标，正在研究两个更细粒度的问题。这些调查构成了该项目的新颖之处，也是设计更好的网络防御系统的关键因素。首先，对软件漏洞利用的预测是通过分类技术进行的，这些分类技术将黑客在黑客论坛和市场上的数字痕迹以及安全建议与现实世界的黑客尝试联系起来。然后对积极的预测（即它将被利用）进行补丁优先级排序，克服了该领域机器学习工作未解决的两个当前缺点：1)预测的利用缺乏差异化，2)缺乏预测的时间间隔。其次，恶意信息级联的预期，可能传播到病毒的比例也执行。在这里，利用社会网络分析的分类技术用于提取黑客拓扑信息并估计社会影响，预测黑客论坛中包含的哪些技术、策略或漏洞可能在不久的将来被广泛采用。这两个项目的努力都将带来预测具有时间敏感性的网络威胁的新技术，使防御者在与攻击者的战斗中有更好的机会。项目可交付成果、数据和模型将通过安全社区传播。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Information for cyber-attack deployment has been increasingly shared by hackers on the underground world of the darkweb. In those hidden and anonymous environments, cyber criminals discuss how to 1) identify software vulnerabilities, 2) create or purchase exploits, 3) choose a target and recruit collaborators, 4) obtain access to the infrastructure needed, and 5) plan and execute the attack. Although this behavior helps hackers to produce a huge amount of malware, it also provides valuable intelligence for defenders, as the information shared online can be leveraged as precursors to various types of cyber threats. By relying on proactive cyber-threat intelligence analysis, this project addresses the following key research question: can emerging cyber-threats be accurately and aforesaid predicted? With continuous retrieval and analysis of hacker communication, this research will shed light on the assets, capabilities, behaviors, and interests of malicious hackers that can be leveraged for establishing cyber threat prediction.To accomplish that, two finer-grained problems are being investigated. These investigations constitute the project’s novelties and are key factors for the design of better cyber-defense systems. First, the prediction of software vulnerability exploitation is conducted through classification techniques that correlate hackers' digital traces on hacker forums and marketplaces, and security advisories with real- world hacking attempts. The positive predictions (i.e., it will be exploited) are then ranked for patch prioritization, overcoming two current shortcomings not addressed by machine learning work in this domain: 1) the lack of differentiation of the predicted exploitation and 2) the lack of time interval for predictions. Second, the anticipation of malicious information cascades that might propagate to viral proportions is also performed. Here, classification techniques leveraging social network analysis are used to extract hacker topological information and to estimate social influence, predicting which techniques, strategies, or exploits included in hacking forums might be widely adopted in the near future. Both project efforts will lead to new techniques to predict cyber threats that are time sensitive, giving defenders a better chance in the fight against attackers. The project deliverables, data and models, will be disseminated through the security community.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.