An Automated Methodology for Validating Web Related Cyber Threat Intelligence by Implementing a Honeyclient
Name
Ivo Pure
Abstract
This paper is contributing to the open source cybersecurity community by providing an alternative methodology for analyzing web related cyber threat intelligence. Websites are used commonly as an attack vector to spread malicious content crafted by any malicious party. These websites become threat intelligence which can be stored and collected into corresponding databases. Eventually these cyber threat databases become obsolete and can lead to false positive investigations in cyber incident response. The solution is to keep the threat indicator entries valid by verifying their content and this process can be fully automated to keep the process less time consuming. The proposed technical solution is a low interaction honeyclient regularly tasked to verify the content of the web based threat indicators. Due to the huge amount of database entries, this way most of the web based threat indicators can be automatically validated with less time consumption and they can be kept relevant for monitoring purposes and eventually can lead to avoiding false positives in an incident response processes.
Graduation Thesis language
English
Graduation Thesis type
Master - Cyber Security
Supervisor(s)
Risto Vaarandi, Raimundas Matulevicius
Defence year
2019