SaTC: CORE: Small: Scalable and Meaningful Threat Intelligence Generation

威胁情报被组织用来通过检测和阻止与已知攻击者系统的通信来保护系统和最终用户。高质量的威胁情报还可以提供检测攻击者工具的方法，这些工具通常不像他们的攻击基础设施那么短暂。不幸的是，产生高质量的威胁情报往往是一个高度手动和低效的过程。这导致有用的威胁情报数量有限，只能提供给那些负担得起的公司。这项研究开发了新的数据分析方法来识别攻击者的基础设施和攻击工具。我们的方法利用高效收集大量原始攻击者数据的能力，对其进行处理，并构建人工智能技术来发现攻击模式。该项目提高了生成高质量威胁情报数据的效率，并使更多公司能够负担得起。要实现这一提高生成有用威胁情报效率的目标，需要在几个关键挑战上取得进展。该项目(I)研究基于监督机器学习的方法，高效地从攻击者那里收集大规模数据，(Ii)改进存储这些数据和其他免费可用的原始威胁情报数据的方法，以便可以轻松地连接这些数据，(Iii)识别可以从这些原始数据中提取的健壮特征，这些特征可以用于培训监督机器学习检测技术，以及(Iv)能够高性能和高效地生成大规模有用的威胁情报数据。因此，本研究具有改变威胁情报数据生成方式的潜力，并通过使威胁情报更容易访问来提高组织的安全性。这项工作还为本科生和研究生创造了许多教育机会，让他们利用数据分析技术获得经验，有效地检测新出现的威胁并提高组织的安全性。

Threat intelligence is used by organizations to protect systems and end-users by detecting and blocking communications with known attackers' systems. Quality threat intelligence can also provide methods of detecting attackers' tools, which are often less ephemeral than their attack infrastructure. Unfortunately, producing quality threat intelligence is often a highly manual and inefficient process. This has resulted in limited amounts of useful threat intelligence which is available only to those companies that can afford it. This research develops new data-analytics methods to identify an attacker's infrastructure and attack tools. Our methods leverage the ability to efficiently collect large amounts of raw attacker data, process it, and build artificial intelligence techniques to discover attack patterns. This project improves the efficiency of generating high quality threat intelligence data, and makes it more affordable to a large range of companies. Achieving this goal of improving the efficiency of generating useful threat intelligence requires progress on several key challenges. The project (i) investigates supervised machine learning based methods for efficiently collected large-scale amounts of data from attackers, (ii) improves methods for storing this data and other freely available raw threat intelligence data such that it can be easily joined, (iii) identifies robust features that can be extracted from this raw data which can be used for training supervised machine learning detection techniques, and (iv) enables high performance and efficient generation of large-scale useful threat intelligence data. Consequently, this research has the potential to transform the way in which threat intelligence data is produced and improve the security of organizations by making threat intelligence more accessible. This work also creates many educational opportunities for undergraduate and graduate students to gain experience using data-analytics techniques to efficiently detect emerging threats and improve the security of organizations.