Decaying Indicators of Compromise

03/29/2018

∙

The steady increase in the volume of indicators of compromise (IoC) as well as their volatile nature makes their processing challenging. Once compromised infrastructures are cleaned up, threat actors are moving to on to other target infrastructures or simply changing attack strategies. To ease the evaluation of IoCs as well as to harness the combined analysis capabilities, threat intelligence sharing platforms were introduced in order to foster collaboration on a community level. In this paper, the open-source threat intelligence platform MISP is used to implement and showcase a generic scoring model for decaying IoCs shared within MISP communities matching their heterogeneous objectives. The model takes into account existing meta-information shared along with indicators of compromise,facilitating the decision making process for machines in regards to the validity of the shared indicator of compromise. The model is applied on common use-cases that are normally encountered during incident response.

READ FULL TEXT

Decaying Indicators of Compromise

Taxonomy driven indicator scoring in MISP threat intelligence platforms

Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence

Threat Actor Type Inference and Characterization within Cyber Threat Intelligence

Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI

POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting

THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums

On the Computation of Accessibility Provided by Shared Mobility

Decaying Indicators of Compromise

Related Research

Taxonomy driven indicator scoring in MISP threat intelligence platforms

Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence

Threat Actor Type Inference and Characterization within Cyber Threat Intelligence

Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI

POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting

THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums

On the Computation of Accessibility Provided by Shared Mobility