| Download | - View final version: Cyber threat hunting: a cognitive endpoint behavior analytic system (PDF, 835 KiB)
|
|---|
| DOI | Resolve DOI: https://doi.org/10.4018/IJCINI.20211001.oa9 |
|---|
| Author | Search for: Khan, Muhammad Salman; Search for: Richard, Rene1ORCID identifier: https://orcid.org/0000-0002-1342-6225; Search for: Molyneaux, Heather1; Search for: Cote-Martel, Danick; Search for: Kamalanathan Elango, Henry Jackson1; Search for: Livingstone, Steve; Search for: Gaudet, Manon1ORCID identifier: https://orcid.org/0000-0002-2119-9149; Search for: Trask, Dave |
|---|
| Affiliation | - National Research Council of Canada. Digital Technologies
|
|---|
| Format | Text, Article |
|---|
| Subject | cognitive analysis; cognitive command and control; cognitive machine learning; cyber security operation center; cyber threats; endpoint behavior; prediction; SARIMA; streaming; time series; training |
|---|
| Abstract | Security and Information Event Management (SIEM) systems require significant manual input; SIEM tools with machine learning minimizes this effort but are reactive and only effective if known attack patterns are captured by the configured rules and queries. Cyber threat hunting, a proactive method of detecting cyber threats without necessarily knowing the rules or pre-defined knowledge of threats, still requires significant manual effort and is largely missing the required machine intelligence to deploy autonomous analysis. This paper proposes a novel and interactive cognitive and predictive threat-hunting prototype tool to minimize manual configuration tasks by using machine intelligence and autonomous analytical capabilities. This tool adds proactive threat-hunting capabilities by extracting unique network communication behaviors from multiple endpoints autonomously while also providing an interactive UI with minimal configuration requirements and various cognitive visualization techniques to help cyber experts quickly spot events of cyber significance from high-dimensional data. |
|---|
| Publication date | 2021-10 |
|---|
| Publisher | IGI Global |
|---|
| Licence | |
|---|
| In | |
|---|
| Language | English |
|---|
| Peer reviewed | Yes |
|---|
| Export citation | Export as RIS |
|---|
| Report a correction | Report a correction (opens in a new tab) |
|---|
| Record identifier | caad1d5e-950c-42bf-a0f6-90f302579b8c |
|---|
| Record created | 2023-06-09 |
|---|
| Record modified | 2023-06-09 |
|---|
