Current Challenges of Cyber Threat and Vulnerability Identification Using Public Enumerations
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14610%2F22%3A00126131" target="_blank" >RIV/00216224:14610/22:00126131 - isvavai.cz</a>
Result on the web
<a href="http://dx.doi.org/10.1145/3538969.3544458" target="_blank" >http://dx.doi.org/10.1145/3538969.3544458</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1145/3538969.3544458" target="_blank" >10.1145/3538969.3544458</a>
Alternative languages
Result language
angličtina
Original language name
Current Challenges of Cyber Threat and Vulnerability Identification Using Public Enumerations
Original language description
Identification of cyber threats is one of the essential tasks for security teams. Currently, cyber threats can be identified using knowledge organized into various formats, enumerations, and knowledge bases. This paper studies the current challenges of identifying vulnerabilities and threats in cyberspace using enumerations and data about assets. Although enumerations are used in practice, we point out several issues that still decrease the quality of vulnerability and threat identification. Since vulnerability identification methods are based on network monitoring and agents, the issues are related to the asset discovery, the precision of vulnerability discovery, and the amount of data. On the other hand, threat identification utilizes graph-based, nature-language, machine-learning, and ontological approaches. The current trend is to propose methods that utilize tactics, techniques, and procedures instead of low-level indicators of compromise to make cyber threat identification more mature. Cooperation between standards from threat, vulnerability, and asset management is also an unresolved issue confirmed by analyzing relationships between public enumerations and knowledge bases. Last, we studied the usability of techniques from the MITRE ATT&CK knowledge base for threat modeling using network monitoring to capture data. Although network traffic is not the most used data source, it allows the modeling of almost all tactics from the MITRE ATT&CK.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10200 - Computer and information sciences
Result continuities
Project
—
Continuities
S - Specificky vyzkum na vysokych skolach
Others
Publication year
2022
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
The 17th International Conference on Availability, Reliability and Security (ARES 2022)
ISBN
9781450396707
ISSN
—
e-ISSN
—
Number of pages
8
Pages from-to
1-8
Publisher name
ACM
Place of publication
Vienna, Austria
Event location
Vienna, Austria
Event date
Jan 1, 2022
Type of event by nationality
CST - Celostátní akce
UT code for WoS article
—