Digital Threats: Research and Practice最新文献_第2页

Web Application Security: A Pragmatic Exposé 网络应用安全：务实揭秘

Digital Threats: Research and Practice Pub Date : 2024-02-07 DOI: 10.1145/3644394

Clement C. Aladi

引用次数: 0

A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center 网络安全运营中心高效警报管理的机器学习和优化框架

Digital Threats: Research and Practice Pub Date : 2024-02-05 DOI: 10.1145/3644393

Jalal Ghadermazi, Ankit Shah, Sushil Jajodia

{"title":"A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center","authors":"Jalal Ghadermazi, Ankit Shah, Sushil Jajodia","doi":"10.1145/3644393","DOIUrl":"https://doi.org/10.1145/3644393","url":null,"abstract":"Cybersecurity operations centers (CSOCs) protect organizations by monitoring network traffic and detecting suspicious activities in the form of alerts. The security response team within CSOCs is responsible for investigating and mitigating alerts. However, an imbalance between alert volume and available analysts creates a backlog, putting the network at risk of exploitation. Recent research has focused on improving the alert management process by triaging alerts, optimizing analyst scheduling, and reducing analyst workload through systematic discarding of alerts. However, these works overlook the delays caused in alert investigations by several factors, including: (i) False or benign alerts contributing to the backlog. (ii) Analysts experiencing cognitive burden from repeatedly reviewing unrelated alerts. (iii) Analysts being assigned to alerts that do not match well with their expertise. We propose a novel framework that considers these factors and utilizes machine learning and mathematical optimization methods to dynamically improve throughput during work shifts. The framework achieves efficiency by automating the identification and removal of a portion of benign alerts, forming clusters of similar alerts, and assigning analysts to alerts with matching attributes. Experiments conducted using real-world CSOC data demonstrate a 60.16% reduction in the alert backlog for an 8-hour work shift compared to currently employed approach.","PeriodicalId":202552,"journal":{"name":"Digital Threats: Research and Practice","volume":"30 6","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139804195","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center 网络安全运营中心高效警报管理的机器学习和优化框架

Digital Threats: Research and Practice Pub Date : 2024-02-05 DOI: 10.1145/3644393

Jalal Ghadermazi, Ankit Shah, Sushil Jajodia

{"title":"A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center","authors":"Jalal Ghadermazi, Ankit Shah, Sushil Jajodia","doi":"10.1145/3644393","DOIUrl":"https://doi.org/10.1145/3644393","url":null,"abstract":"Cybersecurity operations centers (CSOCs) protect organizations by monitoring network traffic and detecting suspicious activities in the form of alerts. The security response team within CSOCs is responsible for investigating and mitigating alerts. However, an imbalance between alert volume and available analysts creates a backlog, putting the network at risk of exploitation. Recent research has focused on improving the alert management process by triaging alerts, optimizing analyst scheduling, and reducing analyst workload through systematic discarding of alerts. However, these works overlook the delays caused in alert investigations by several factors, including: (i) False or benign alerts contributing to the backlog. (ii) Analysts experiencing cognitive burden from repeatedly reviewing unrelated alerts. (iii) Analysts being assigned to alerts that do not match well with their expertise. We propose a novel framework that considers these factors and utilizes machine learning and mathematical optimization methods to dynamically improve throughput during work shifts. The framework achieves efficiency by automating the identification and removal of a portion of benign alerts, forming clusters of similar alerts, and assigning analysts to alerts with matching attributes. Experiments conducted using real-world CSOC data demonstrate a 60.16% reduction in the alert backlog for an 8-hour work shift compared to currently employed approach.","PeriodicalId":202552,"journal":{"name":"Digital Threats: Research and Practice","volume":"37 1","pages":""},"PeriodicalIF":0.0,"publicationDate":"2024-02-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139864173","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Introduction to the Special Issue on Information Sharing 信息共享特刊导言

Digital Threats: Research and Practice Pub Date : 2024-01-17 DOI: 10.1145/3635391

Angel Hueca, Sharon Mudd, Timothy Shimeall

引用次数: 0

A Survey on Network Attack Surface Mapping 网络攻击面映射调查

Digital Threats: Research and Practice Pub Date : 2024-01-10 DOI: 10.1145/3640019

D. Everson, Long Cheng

引用次数: 0

Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning 多空间网络钓鱼：利用机器学习扩展针对钓鱼网站检测器的对抗性攻击的规避空间

Digital Threats: Research and Practice Pub Date : 2023-12-20 DOI: 10.1145/3638253

Ying Yuan, Giovanni Apruzzese, Mauro Conti

{"title":"Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning","authors":"Ying Yuan, Giovanni Apruzzese, Mauro Conti","doi":"10.1145/3638253","DOIUrl":"https://doi.org/10.1145/3638253","url":null,"abstract":"Existing literature on adversarial Machine Learning (ML) focuses either on showing attacks that break every ML model, or defenses that withstand most attacks. Unfortunately, little consideration is given to the actual feasibility of the attack or the defense. Moreover, adversarial samples are often crafted in the “feature-space”, making the corresponding evaluations of questionable value. Simply put, the current situation does not allow to estimate the actual threat posed by adversarial attacks, leading to a lack of secure ML systems. We aim to clarify such confusion in this paper. By considering the application of ML for Phishing Website Detection (PWD), we formalize the “evasion-space” in which an adversarial perturbation can be introduced to fool an ML-PWD—demonstrating that even perturbations in the “feature-space” are useful. Then, we propose a realistic threat model describing evasion attacks against ML-PWD that are cheap to stage, and hence intrinsically more attractive for real phishers. After that, we perform the first statistically validated assessment of state-of-the-art ML-PWD against 12 evasion attacks. Our evaluation shows (i) the true efficacy of evasion attempts that are more likely to occur; and (ii) the impact of perturbations crafted in different evasion-spaces; Our realistic evasion attempts induce a statistically significant degradation (3–10% at p < 0.05), and their cheap cost makes them a subtle threat. Notably, however, some ML-PWD are immune to our most realistic attacks (p=0.22). Finally, as an additional contribution of this journal publication, we are the first to propose and empirically evaluate the intriguing case wherein an attacker introduces perturbations in multiple evasion-spaces at the same time. These new results show that simultaneously applying perturbations in the problem- and feature-space can cause a drop in the detection rate from 0.95 to 0. Our contribution paves the way for a much-needed re-assessment of adversarial attacks against ML systems for cybersecurity.","PeriodicalId":202552,"journal":{"name":"Digital Threats: Research and Practice","volume":"25 10","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-12-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"138955882","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Spacelord: Private and Secure Smart Space Sharing Spacelord：私密安全的智能空间共享

Digital Threats: Research and Practice Pub Date : 2023-12-19 DOI: 10.1145/3637879

Yechan Bae, Sarbartha Banerjee, Sangho Lee, Marcus Peinado

引用次数: 0

Introduction to the Special Issue on Ransomware 勒索软件特刊简介

Digital Threats: Research and Practice Pub Date : 2023-11-17 DOI: 10.1145/3629999

Budi Arief, Lena Connolly, Julio Hernandez-Castro, Allan Liska, Peter Y A. Ryan

引用次数: 0

Unveiling the Threat: Investigating Distributed and Centralized Backdoor Attacks in Federated Graph Neural Networks 揭示威胁：研究联盟图神经网络中的分布式和集中式后门攻击

Digital Threats: Research and Practice Pub Date : 2023-11-16 DOI: 10.1145/3633206

Jing Xu, Stefanos Koffas, S. Picek

{"title":"Unveiling the Threat: Investigating Distributed and Centralized Backdoor Attacks in Federated Graph Neural Networks","authors":"Jing Xu, Stefanos Koffas, S. Picek","doi":"10.1145/3633206","DOIUrl":"https://doi.org/10.1145/3633206","url":null,"abstract":"Graph Neural Networks (GNNs) have gained significant popularity as powerful deep learning methods for processing graph data. However, centralized GNNs face challenges in data-sensitive scenarios due to privacy concerns and regulatory restrictions. Federated learning (FL) has emerged as a promising technology that enables collaborative training of a shared global model while preserving privacy. While FL has been applied to train GNNs, no research focuses on the robustness of Federated GNNs against backdoor attacks. This paper bridges this research gap by investigating two types of backdoor attacks in Federated GNNs: centralized backdoor attacks (CBA) and distributed backdoor attacks (DBA). Through extensive experiments, we demonstrate that DBA exhibits a higher success rate than CBA across various scenarios. To further explore the characteristics of these backdoor attacks in Federated GNNs, we evaluate their performance under different scenarios, including varying numbers of clients, trigger sizes, poisoning intensities, and trigger densities. Additionally, we explore the resilience of DBA and CBA against two defense mechanisms. Our findings reveal that both defenses can not eliminate DBA and CBA without affecting the original task. This highlights the necessity of developing tailored defenses to mitigate the novel threat of backdoor attacks in Federated GNNs.","PeriodicalId":202552,"journal":{"name":"Digital Threats: Research and Practice","volume":"23 5","pages":""},"PeriodicalIF":0.0,"publicationDate":"2023-11-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"139270573","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

IronNetInjector: Weaponizing .NET Dynamic Language Runtime Engines 使。net动态语言运行时引擎武器化

Digital Threats: Research and Practice Pub Date : 2023-10-06 DOI: 10.1145/3603506

Anthony Rose, S. Graham, Jacob Krasnov

{"title":"IronNetInjector: Weaponizing .NET Dynamic Language Runtime Engines","authors":"Anthony Rose, S. Graham, Jacob Krasnov","doi":"10.1145/3603506","DOIUrl":"https://doi.org/10.1145/3603506","url":null,"abstract":"As adversaries evolve their Tactics, Techniques, and Procedures (TTPs) to stay ahead of defenders, Microsoft’s .NET Framework emerges as a common component found in the tradecraft of many contemporary Advanced Persistent Threats (APTs), whether through PowerShell or C#. Because of .NET’s ease of use and availability on every recent Windows system, it is at the forefront of modern TTPs and is a primary means of exploitation. This article considers the .NET Dynamic Language Runtime as an attack vector, and how APTs have utilized it for offensive purposes. The technique under scrutiny is Bring Your Own Interpreter (BYOI), which is the ability of developers to embed dynamic languages into .NET using an engine. The focus of this analysis is an adversarial use case in which APT Turla utilized BYOI as an evasion technique, using an IronPython .NET Injector named IronNetInjector. This research analyzes IronNetInjector and how it was used to reflectively load .NET assemblies. It also evaluates the role of Antimalware Scan Interface (AMSI) in defending Windows. Due to AMSI being at the core of Windows malware mitigation, this article further evaluates the memory patching bypass technique by demonstrating a novel AMSI bypass method in IronPython using Platform Invoke (P/Invoke).","PeriodicalId":202552,"journal":{"name":"Digital Threats: Research and Practice","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-10-06","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132231616","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0