so hello good evening my name is Wu and
I'll try to keep this short because I
guess everyone just wants to go and have
dinner and a beer I sure do
so actually some of the issues that were
discussed during the Q&A is from
previous presentations were the topic of
my thesis which is the enrichment and
creation of IOC's of quality out of a
since it was my master's thesis
those are my advisers and I did it in
the university of lisbon why is why do
we care about this because the same
reason why we know will not get out of a
job in the near future it costs a lot of
money 4 percent of global GDP next year
is expected to be lost to cybercrime and
why does this happen two reasons we're
working against people that are highly
focused and highly dedicated to what
they're doing they see that the return
on investments is has a lot of potential
and they also are using new ways of
attacking which also increase the
difficulty that we have in combating
this threat so where are we we started
by having no defenses whatsoever and the
beginning the internet was something
that was supposed to be for sharing and
no one even considered the hypothesis of
it's being misused it quickly we
understood the error of our ways and we
started installing perimeter defenses
the problem with the perimeter defense
is if you build a wall if someone
manages to cross that wall you don't
have anything else so we move to in that
defenses which works fine until you find
an adversary that is capable of adapting
to the what you have within your network
and creates you will change the way he
is attacking to adapt to your new to
what you're monitoring and so we moved
to dynamic response defense which is
three things advanced malware detection
event anomaly detection and what brings
us all here intelligence driven defense
and that's where we decided to work so
where are we now in this field we moved
to from manually sharing their knowledge
to creating platforms to help us share
the knowledge however and most of you
are surely aware there was a report by
in Issa and the beginning of this year
which criticized the initiatives not in
the sense that they weren't needed but
in the sense that we still have a lot to
work until we get to a place where we
can be comfortable what with the efforts
we're putting into this field and so
they I indicated a lot of issues that
appear first of all we have a high
volume of information that is shared
which makes it hard for people to
understand what they're seeing and to
get the information that they need
furthermore we don't have common sharing
standards we have certain standards that
are more use than others but we should
move towards something that is everyone
agrees it's the way to go and we all use
the same standards instead of having in
my platform I have to have a converter
at the end I have to have other
converters so that I can receive input
and then output the information for
something that you other people can use
and we are collecting data we're not
doing intelligence this is a very
serious issue because collecting data is
not the same as creating intelligence
creating intelligence is answering a
question that you need to have answered
collecting data is just or D and that's
what most of the platforms are currently
doing we're ordering data but then we
have a hard time making it into
something useful so out of these issues
or the thesis we had to choose something
to focus on and we decided to focus on
three challenges first we wanted to
reduce the quantity of information that
reaches the analysts we don't want the
analysts to have to sort through all the
information that is receiving
a daily basis if we consider that there
are tens of thousands of new malware
samples that are detected daily it's
impossible for a human being to deal
with that kind of information second we
want to increase the quality of the
information that is being shared or of
the intelligence
this means four things we have to reduce
the timeliness the time between
detection and the information actually
sharing reaching its goal so the
information analysts the security
analysts or the systems that are
defending our network we have to
guarantee that it's both accurate and
relevant so we have to guarantee that
the information that we are using
actually has some answers or needs and
it's not if I work in a bank and I
actually do I don't care about the
treads
that's effects like those navigation
systems of an airplane I just care about
stress that's will impact on what I have
within my network and finally
completeness and here it's something
that it was approached in the last talk
in the sense which is if we use
different names when we're analyzing a
different same sample when we reach the
end and if I'm analyzing the network
part of the malware and someone is
analyzing the system part we'll reach
two different IO sees that won't be
related and in the end maybe they are in
my database both of them but I'll lose
part of that information because they
aren't connected
and finally automation is key we don't
want to lose time having someone to have
to work on that information we want to
have something that we let go we
configure it and after that it's just
running on our system and completing it
so we looked at NIST as a solution to
start implementing our solution and what
we found is new events can be duplicates
which means it increases the storage
requirements and it's information that's
not useful to anyone that's
we're soaring there ii miss creates
direct connections which means and we've
seen multiple representations during the
day you have an event you see all the
events that share attributes with that
one what if the next one on that level
is something useful to us you would have
to go manually or lose the information
which means that you're either losing
time or losing information so we try to
resolve this situation how first of all
we considered clustering and aggregating
information that is related to one
another so as to create a new enriched
IOC which brings all the information
that is connected into a single report
that will reach the analyst this means
working at two levels of the
architecture we have to work in the
configuration of the threat intelligence
platform which means we have to know
what we want to answer so that we make
the correct choices when preparing our
platform to answer them and second we
have to work in the internal processing
capabilities which is the platform needs
to be able to do this operation by
itself instead of doing it you instead
of disappear the analyst doing it so
then lastly Automation by the design
which is basically something that is
required at pre requirement for anything
we do so we designed this solution we
have the sources which should be focused
on thread feeds that matter to us we
have a layer of other threat
intelligence platforms to try to use
what they bring to the to the what they
bring to the product and by this I mean
for instance using in talent you to
enrich IPS and DNS so that when we have
the information reaching what we
developed we have hooks and hooks here
are information that will allow to
create connections to other events that
we have in our database and we created
two modules that the duplicator module
which has the name indicates allow us to
eliminate information that no serves no
purpose because it's a duplicate and a
correlator module which has an
aggregation part and a representation
part to create even rich deoxy so how do
the duplication work we considered an
event as a set and if we consider an
event as a set of attributes you can use
set theory to compare two events and to
decide which one should be this means
that you have to have criterias and the
criterias are found within the metadata
so you'll see for instance if you have
to add events that are have the same
information you see if one of them has
already been validated by human so if
the dress level is higher you can
consider that that one is more valuable
than the previous one which was still
has so hadn't been analyzed and so forth
regarding aggregation methods we the we
defined two methods one of them is
closer to what nest Pass which is the
naive method and we basically focus on
the naive methods on direct connection
so we look at an event we see if it
shares attributes with other events and
then we take that group of events as a
cluster and a potential new enriched
yolk this has a problem an event can
appear on multiple clusters which is
logical we have another alternative
which is the N level aggregation in the
end a level of aggregation what we do
and similarly what you were doing is we
create a graph with where the nodes or
new events or all the events in our
database we then look at shared
attributes to create edges and we set
filters to allow only certain edges to
be created and then we that identify all
the sub graphs and those sub graphs will
form and you enrich to your pour a new
possible enriched yaagh
just an image to give an example if we
were using the knife approach consider
that we have these events in the
database when we look at the first
events it shares one attribute with the
second one in rich dark we move to the
second another energy are another
enriched job and so forth if we move to
an end level aggregation with the same
using exactly the same database we will
first create the notes represent the
notes we would then for each relation
create an edge and finally we would
identify all the sub graphs that exist
in this case we have two and these two
would be possible
enriched yachts so we needed to make a
proof of concept so we developed an
peyten tree over a mis installation we
focused in these two modules so we
basically used everything that miss we
could use out of nests so as not to lose
time I didn't have that much time to
develop so it was basically get the most
out of nests and we made the
implementation to allow two two choices
the first one is we could choose subsets
of yolks that are in our database and
use them as do the selection that way
well at this time we were just working
in a proof-of-concept so we didn't have
a specific target in the future this
would allow if we want to focus on
specific sectors or in specific threats
we can select only those yokes that are
in our database that relate to that
issue instead of losing time analyzing
all the database then we also we also
made valid relationships so we set
different filters that could be used to
make the creation of the enriched yachts
and we made two important assumptions
the first one is trust level correlates
to quality which means that we are
pressing the other participants that
contributes to our database that
if they set a trust level at two they
did their job and that the quality of
the information of that invent is
actually better than another event that
is in the network without having being
certified and that black lists are
correctly tagged this is extremely
important and black lists aren't the
only case there are other types of
events that appear that can mess up the
way we're doing things because they if
you have an event that creates
relationships that aren't indeed useful
it will create an enriched yuk that has
no value
so if you have an a black list it will
bring events from difference incidents
because some of them only lists I piece
without caring if they are related to a
single threat and they will cooperate
everything around them and it's a mess
so we selected an experimental set we
had like we opened 34 feeds from of
organizations collected eleven hundred
and seventy-four events most of them as
you can see are of a high trust level so
in our vision of the world they actually
have high quality and we ran our
platform on that they decide to see how
it would work
and so we did we selected the subset
only those with a trust level of two
were selected and we eliminated all
those that had a tag of blacklist and we
said okay let's see with all the filters
that are currently connected how does it
work and as you can see there are two
factors here that are important or that
are interesting as the filter goes
deeper in detail you reduce the number
of enriched of potentially enriched
yolks that you have which makes sense
because you allow less connections and
the connections that you allow are those
that interest you the most and if you
use the native approach you get a lot
more potential than rich jerks
then if you use the closer approach so
after doing this first experiments we
focused on the cluster approach with the
most restrictive filter
and what we got was this we found 11
potentially enriched chucks which we
then manually went through the their
components and they make sense in here
it's make sense because it's it's the
data sets is still not we needed a
bigger data set we needed to have
evaluate this in a different way we have
developed metrics like you did to try to
to make sense of the information and try
to validate what we have but it's still
an ongoing process to be able to relate
for certain the relevance of these
enriched drugs and actually and you'll
see that that's something at work that
is currently being done so this is a
representation of what we got when we
represented the graph and we're going to
look just at the details of one of them
so this is the enriched df9 it's
composed of several difference attribute
events that are all related or mostly
related through this vulnerability and
another one appears related through this
vulnerability the filter we were using
was if the events shared vulnerability
or attackers so to make to bring forth
something that made more sense and would
be more useful and so here we have the
the list of events that compose it not
very interesting one interesting factor
is and that's something that has
appeared in the literature is DF you can
see if you look at this kind of data you
can see the evolution of a track or in
this case for instance the evolution
from 2014 to 2016 of a vulnerability
over time who used it when why to attack
who so this sort of information at the
strategic level we are already getting
something that is useful but now at the
tactical level were where we're going to
use these Yuk's to inject into a defense
network so needs some working to do just
to be sure that when we create rules we
are
actually creating rules that are useful
and not just cluttering the system so
conclusion we created a new system to to
create intelligence out of us since we
defined two methods to correlate and
aggregate threat intelligence we
developed the platform that proves that
the methods sort of work and we did an
experiment that shows that our proof of
concept was working and as I was saying
currently we are this was work within
the project of DCM which is a European
sponsored project and we're working with
a partner to evaluate the risk score of
the detected yolks and thank you
[Applause]
so repeat repeating the question if I
understood it correctly is if the
approach we're using is not comfort
productive in the long run because we're
limiting the access of the information
and it's a good point what the one you
make it's a good point because indeed it
can happen and even if it doesn't and
when it happens like you could have had
the information in the past but this is
still like this is the beginning of the
beginning of doing this one part of the
problem with this issue is for instance
or threat intelligence quality there is
nothing to quantify it I've looked for
it because it should be something that
you should be able to quantify it but
it's something that you're it's on a
case-by-case basis and what you're
saying makes sense but what I can say is
it all depends on the configurations and
that's why it's so important at the
beginning it I'm not saying that you're
wrong you're absolutely correct that you
should have the best database possible
the idea is to only get the information
that matters at that moment to the
people that are working because you can
always have that in storage you can
accumulate whatever knowledge you think
will useful in the future in your
storage and then use it to process it
later on because the the idea is that is
that this should will work automatically
so currently it's on a I need to run the
the platform basis but it was created
and I designed it so that you could put
it as a thread and it will basically be
running over and over on your database
and checking for the creation of new
enriched yokes or potentially enriched
jobs and yes currently I have a concern
about false positives because we don't
know what a false positive is so if you
don't we got eleven potential enriched
yokes and that's for me and it's an
issue that I have with my instance with
my advisors because for them it's yeah
you created these enriched yokes
no I created eleven events that have the
information from other events that
should be correlated but there is no way
to be certain at this point that they
are actually what we've created is
better than what we had in the past and
so it's right now we have the proof of
concept and we created something the
future is with the risk score seeing if
that's something that we're creating has
added value and we can see with the
human eye some added value because you
can see for instance difference on a
vulnerability that reappears over time
which would probably not be that's is it
easy to detect you can create other like
we created measures to see how the how
different events and event evolves over
time so you can get those metrics but
this is thus the beginning of a new age
more questions no thank you
you