SaTC: CORE: Small: Scalable and Meaningful Threat Intelligence Generation

SaTC：核心：小型：可扩展且有意义的威胁情报生成

• 批准号: 1717062
• 负责人: Damon McCoy
• 金额: $ 49.21万
• 依托单位: New York University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-08-15 至 2021-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1717062&HistoricalAwards=false
• 关键词: SaTC; CORE; Small; Scalable; Meaningful

Threat intelligence is used by organizations to protect systems and end-users by detecting and blocking communications with known attackers' systems. Quality threat intelligence can also provide methods of detecting attackers' tools, which are often less ephemeral than their attack infrastructure. Unfortunately, producing quality threat intelligence is often a highly manual and inefficient process. This has resulted in limited amounts of useful threat intelligence which is available only to those companies that can afford it. This research develops new data-analytics methods to identify an attacker's infrastructure and attack tools. Our methods leverage the ability to efficiently collect large amounts of raw attacker data, process it, and build artificial intelligence techniques to discover attack patterns. This project improves the efficiency of generating high quality threat intelligence data, and makes it more affordable to a large range of companies. Achieving this goal of improving the efficiency of generating useful threat intelligence requires progress on several key challenges. The project (i) investigates supervised machine learning based methods for efficiently collected large-scale amounts of data from attackers, (ii) improves methods for storing this data and other freely available raw threat intelligence data such that it can be easily joined, (iii) identifies robust features that can be extracted from this raw data which can be used for training supervised machine learning detection techniques, and (iv) enables high performance and efficient generation of large-scale useful threat intelligence data. Consequently, this research has the potential to transform the way in which threat intelligence data is produced and improve the security of organizations by making threat intelligence more accessible. This work also creates many educational opportunities for undergraduate and graduate students to gain experience using data-analytics techniques to efficiently detect emerging threats and improve the security of organizations.

组织使用威胁情报来检测和阻止与已知攻击者系统的通信，从而保护系统和最终用户。高质量威胁情报通常是一个高度手动且低效的过程，这导致有用的威胁情报数量有限，只有那些有能力负担得起的公司才能获得。我们的方法利用有效收集大量原始攻击者数据、处理数据并构建人工智能技术来发现攻击模式的能力，该项目提高了生成高质量威胁情报数据的效率。 ，并使其更适合大量公司，以实现提高生成有用威胁情报的效率的目标，需要在几个关键挑战上取得进展，该项目 (i) 研究基于监督机器学习的方法，以有效收集大量威胁情报。的数据来自攻击者，(ii) 改进存储这些数据和其他免费提供的原始威胁情报数据的方法，以便可以轻松加入，(iii) 识别可以从这些原始数据中提取的强大特征，这些特征可用于训练监督机器学习检测技术，以及（iv）能够高性能、高效地生成大规模有用的威胁情报数据。因此，这项研究有可能改变威胁情报数据的生成方式，并通过生成威胁情报来提高组织的安全性。更多的这项工作还为本科生和研究生创造了许多教育机会，让他们获得使用数据分析技术有效检测新出现的威胁并提高组织安全性的经验。

项目成果

Platforms in Everything: Analyzing Ground-Truth Data on the Anatomy and Economics of Bullet-Proof Hosting

• 发表时间: 2019
• 作者: Arman Noroozian;J. Koenders;Eelco van Veldhuizen;C. Gañán;Sumayah A. Alrwais;Damon McCoy;M. V. Eeten

Clinical Computer Security for Victims of Intimate Partner Violence

亲密伴侣暴力受害者的临床计算机安全

• 发表时间: 2019
• 期刊: 28th USENIX Security Symposium
• 作者: Havron, Sam;Freed, Diana;Chatterjee, Rahul;McCoy, Damon;Dell, Nicola;Ristenpart, Thomas
• 通讯作者: Ristenpart, Thomas

Mapping the Underground: Supervised Discovery of Cybercrime Supply Chains

• DOI: 10.1109/ecrime47957.2019.9037582
• 发表时间: 2019-01-01
• 期刊: 2019 APWG SYMPOSIUM ON ELECTRONIC CRIME RESEARCH (ECRIME)
• 作者: Bhalerao, Rasika;Aliapoulios, Maxwell;McCoy, Damon
• 通讯作者: McCoy, Damon

A Security Analysis of the Facebook Ad Library

Facebook 广告库的安全分析

• DOI: 10.1109/sp40000.2020.00084
• 发表时间: 2020
• 期刊: 2020 IEEE Symposium on Security and Privacy (SP
• 作者: Edelson, Laura;Lauinger, Tobias;McCoy, Damon
• 通讯作者: McCoy, Damon

Swiped: Analyzing Ground-truth Data of a Marketplace for Stolen Debit and Credit Cards

Swiped：分析被盗借记卡和信用卡市场的真实数据

• 发表时间: 2021
• 期刊: Usenix Security Symposium
• 作者: Aliapoulios, Maxwell;Ballard, Cameron;Bhalerao, Rasika;Lauinger, Tobias;McCoy, Damon
• 通讯作者: McCoy, Damon