Towards thwarting cyber corporate espionage by predicting its victims

当企业计算机或员工的个人设备被攻破时，它们就成了垫脚石 更大规模的组织资产渗透。互联网和计算机网络的兴起扩大了 可用信息的范围和细节，以及为网络和商业间谍活动目的而获取的便利程度。 恶意软件和间谍软件被用作商业间谍工具，用于传输商业秘密的数字副本， 客户信息、业务计划和联系人。保护台式机、笔记本电脑、平板电脑和 员工的智能手机并不有效，因此公司越来越多地将重要信息排除在外 网络。检测受损设备、执行取证、恢复数据、清理、 而确保它们的安全是很高的。英国政府最近估计，网络犯罪使国家付出了代价 每年近270亿GB，根据最近的估计，全球每年的成本为1万亿美元。 在这项研究中，我们计划与TELUS合作，以研究早期发现该病的技术 员工设备可能成为网络间谍和其他安全事件的受害者。我们将专注于 基于机器学习和数据挖掘算法开发的预警系统，旨在向高 准确性和可扩展性，使TELUS和更大的研究社区都受益。 我们将研究开发分类器的机器学习技术，该分类器将使用 由各个设备执行的用于识别安全攻击的可能受害者的各种可观察动作， 包括钓鱼、特洛伊木马、DIVE-BY下载等。我们将按照了解-原型-诊断 方法论。

When enterprise computers or individual devices of employees are compromised, they become stepping stones in larger infiltrations of organizational assets. The rise of the Internet and computer networks has expanded the range and detail of information available and the ease of access for the purpose of cyber, corporate espionage. Malware and spyware are used as tools for corporate espionage for transmitting digital copies of trade secrets, customer information, business plans, and contacts. Current means of securing desktops, laptops, tablets, and smartphones of employees are not effective, so companies are increasingly keeping important information off the network. The costs of detecting compromised devices, performing forensics, recovering data, cleaning up, and securing them are high. The UK Government has recently estimated that cybercrime costs the country nearly £27 billion per year and, according to recent estimates, the global cost is $1 trillion every year. In this research, we plan to collaborate with TELUS in order to investigate techniques for early-detection of employee devices that would likely fall victims to cyber espionage and other security incidents. We will focus on machine learning and data mining algorithms to develop an early warning system, with the aim towards high accuracy and scalability, benefiting both TELUS and the larger research community. We will investigate machine learning techniques for developing a classifier that will use traces and logs of various observable actions performed by individual devices for identifying likely victims of security attacks, including phishing, Trojan horses, drive-by-downloads, etc. We will follow the understand-prototype-diagnose methodology.