Evidential Cyber Threat Hunting

04/21/2021

∙

by   Frederico Araujo, et al.

∙

0

∙

share

A formal cyber reasoning framework for automating the threat hunting process is described. The new cyber reasoning methodology introduces an operational semantics that operates over three subspaces – knowledge, hypothesis, and action – to enable human-machine co-creation of threat hypotheses and protective recommendations. An implementation of this framework shows that the approach is practical and can be used to generalize evidence-based multi-criteria threat investigations.