2018/10/29 by Mohammed Almukaynizi, Ericsson Marin, Almukaynizi, Mohammed +11 · 1 citation
Computer Science · #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #Cybercrime and Law Enforcement Studies #FOS: Computer and information sciences #Information and Cyber Security #Network Security and Intrusion Detection #Spam and Phishing Detection
paper · pdf · doi:10.48550/arxiv.1810.12492
openalex publication_date 2018/10/29 · openalex created_date 2022/08/02 · openalex updated_date 2026/07/28
Recent incidents of data breaches call for organizations to proactively\nidentify cyber attacks on their systems. Darkweb/Deepweb (D2web) forums and\nmarketplaces provide environments where hackers anonymously discuss existing\nvulnerabilities and commercialize malicious software to exploit those\nvulnerabilities. These platforms offer security practitioners a threat\nintelligence environment that allows to mine for patterns related to\norganization-targeted cyber attacks. In this paper, we describe a system\n(called DARKMENTION) that learns association rules correlating indicators of\nattacks from D2web to real-world cyber incidents. Using the learned rules,\nDARKMENTION generates and submits warnings to a Security Operations Center\n(SOC) prior to attacks. Our goal was to design a system that automatically\ngenerates enterprise-targeted warnings that are timely, actionable, accurate,\nand transparent. We show that DARKMENTION meets our goal. In particular, we\nshow that it outperforms baseline systems that attempt to generate warnings of\ncyber attacks related to two enterprises with an average increase in F1 score\nof about 45% and 57%. Additionally, DARKMENTION was deployed as part of a\nlarger system that is built under a contract with the IARPA Cyber-attack\nAutomated Unconventional Sensor Environment (CAUSE) program. It is actively\nproducing warnings that precede attacks by an average of 3 days.\n