A Comparative Study on Cyber Threat Intelligence: The Security Incident Response Perspective

被引：61
作者：
Schlette, Daniel [1 ]
Caselli, Marco [2 ]
Pernul, Gunther [1 ]
机构：
[1] Univ Regensburg, Chair Informat Syst, D-93053 Regensburg, Germany
[2] Siemens AG, Dept Cybersecur Technol, D-81739 Munich, Germany
来源：
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS | 2021年 / 23卷 / 04期
基金：
欧盟地平线“2020”;
关键词：
Cyber threat intelligence; incident response; standardization; playbook format; INFORMATION;
D O I：
10.1109/COMST.2021.3117338
中图分类号：
TP [自动化技术、计算机技术];
学科分类号：
0812 ;
摘要：
Cyber Threat Intelligence (CTI) is threat information intended for security purposes. However, use for incident response demands standardization. This study examines the broader security incident response perspective. Introducing 18 core concepts, we assist efforts to establish and assess current standardization approaches. We further provide the reader with a detailed analysis of 6 incident response formats. While we synthesize structural elements, we point to characteristics and show format deficiencies. Also, we describe how core concepts can be used to determine a suitable format for a given use case. Our surveys' findings indicate a consistent focus on incident response actions within all formats. Besides, playbooks are used to represent procedures. Different use cases suggest that organizations can leverage and combine multiple formats. Finally, we discuss open research challenges to fully realize incident response potentials.
引用
收藏
页码：2525 / 2556
页数：32
相关论文
共 79 条
[11]  
Bromiley M, 2019, CISC VIS NETW IND GL
[12]   A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection [J].
Buczak, Anna L. ;
Guven, Erhan .
IEEE COMMUNICATIONS SURVEYS AND TUTORIALS, 2016, 18 (02) :1153-1176
[13]   Leveraging CybOX™ to standardize representation and exchange of digital forensic information [J].
Casey, Eoghan ;
Back, Greg ;
Barnum, Sean .
DIGITAL INVESTIGATION, 2015, 12 :S102-S110
[14]  
Cheikes B. A, 2011, 7695 NIST IR
[15]  
Chismon D., 2015, Technical Report
[16]   A modern threat response framework [J].
Clay, Peter .
Network Security, 2015, 2015 (04) :5-10
[17]  
Cohen M, 2017, AFF4 STANDARD V 1 0
[18]   Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow [J].
Cohen, Michael ;
Garfinkel, Simson ;
Schatz, Bradley .
DIGITAL INVESTIGATION, 2009, 6 :S57-S68
[19]  
Connolly J., 2014, REP
[20]  
Dandurand L., 2014, STANDARDS TOOLS EXCH
12345678