The challenge of detecting sophisticated attacks: Insights from SOC Analysts
The ever-increasing rate of sophisticated cyber-attacks and its subsequent impact on networks has remained a menace to the security community. Existing network security solutions, including those applying machine learning algorithms, often centre their detection on the identification of threats in i...
| Main Authors: | , , |
|---|---|
| Format: | Conference item |
| Published: |
Association for Computing Machinery
2018
|
| _version_ | 1797051659824660480 |
|---|---|
| author | Akinrolabu, O Agrafiotis, I Erola, A |
| author_facet | Akinrolabu, O Agrafiotis, I Erola, A |
| author_sort | Akinrolabu, O |
| collection | OXFORD |
| description | The ever-increasing rate of sophisticated cyber-attacks and its subsequent impact on networks has remained a menace to the security community. Existing network security solutions, including those applying machine learning algorithms, often centre their detection on the identification of threats in individual network events, which is proven inadequate in detecting sophisticated multi-stage attacks. Similarly, SOC analysts whose roles involve detecting advanced threats are faced with a significant amount of false-positive alerts from the existing tools. Their ability to detect novel attacks or variants of existing ones is limited by the lack of expert input from SOC analysts in their creation of the tools; and the use of features that are closely linked to the structure of specific malware which detection models aim to identify. In this work, we conduct a literature review on malware detection tools, reflect on the features used in these approaches and extend the feature-set with novel ones identified by interviewing experienced SOC analysts. We conduct thematic analysis to the qualitative data obtained from the interviews, and our results indicate not only the presence novel generic malware characteristics based on network and application events (web proxy, firewall, DNS), but identify valuable lessons for developing effective SOCs regarding their structure and processes. |
| first_indexed | 2024-03-06T18:22:43Z |
| format | Conference item |
| id | oxford-uuid:06dd7d0f-8cc8-4f86-ad61-073fb5a99c03 |
| institution | University of Oxford |
| last_indexed | 2024-03-06T18:22:43Z |
| publishDate | 2018 |
| publisher | Association for Computing Machinery |
| record_format | dspace |
| spelling | oxford-uuid:06dd7d0f-8cc8-4f86-ad61-073fb5a99c032022-03-26T09:04:36ZThe challenge of detecting sophisticated attacks: Insights from SOC AnalystsConference itemhttp://purl.org/coar/resource_type/c_5794uuid:06dd7d0f-8cc8-4f86-ad61-073fb5a99c03Symplectic Elements at OxfordAssociation for Computing Machinery2018Akinrolabu, OAgrafiotis, IErola, AThe ever-increasing rate of sophisticated cyber-attacks and its subsequent impact on networks has remained a menace to the security community. Existing network security solutions, including those applying machine learning algorithms, often centre their detection on the identification of threats in individual network events, which is proven inadequate in detecting sophisticated multi-stage attacks. Similarly, SOC analysts whose roles involve detecting advanced threats are faced with a significant amount of false-positive alerts from the existing tools. Their ability to detect novel attacks or variants of existing ones is limited by the lack of expert input from SOC analysts in their creation of the tools; and the use of features that are closely linked to the structure of specific malware which detection models aim to identify. In this work, we conduct a literature review on malware detection tools, reflect on the features used in these approaches and extend the feature-set with novel ones identified by interviewing experienced SOC analysts. We conduct thematic analysis to the qualitative data obtained from the interviews, and our results indicate not only the presence novel generic malware characteristics based on network and application events (web proxy, firewall, DNS), but identify valuable lessons for developing effective SOCs regarding their structure and processes. |
| spellingShingle | Akinrolabu, O Agrafiotis, I Erola, A The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title | The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title_full | The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title_fullStr | The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title_full_unstemmed | The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title_short | The challenge of detecting sophisticated attacks: Insights from SOC Analysts |
| title_sort | challenge of detecting sophisticated attacks insights from soc analysts |
| work_keys_str_mv | AT akinrolabuo thechallengeofdetectingsophisticatedattacksinsightsfromsocanalysts AT agrafiotisi thechallengeofdetectingsophisticatedattacksinsightsfromsocanalysts AT erolaa thechallengeofdetectingsophisticatedattacksinsightsfromsocanalysts AT akinrolabuo challengeofdetectingsophisticatedattacksinsightsfromsocanalysts AT agrafiotisi challengeofdetectingsophisticatedattacksinsightsfromsocanalysts AT erolaa challengeofdetectingsophisticatedattacksinsightsfromsocanalysts |