Oslo Analytics (completed)

• Mavroeidis, Vasileios & Jøsang, Audun (2018). Data-Driven Threat Hunting Using Sysmon. In Wang, Yulin (Eds.), 2018 the 2nd International Conference on Cryptography, Security and Privacy. Association for Computing Machinery (ACM). ISSN 9781450363617. p. 82–88. doi: 10.1145/3199478.3199490. Full text in Research Archive Show summary

  Threat actors can be persistent, motivated and agile, and they leverage a diversified and extensive set of tactics, techniques, and procedures to attain their goals. In response to that, organizations establish threat intelligence programs to improve their defense capabilities and mitigate risk. Actionable threat intelligence is integrated into security information and event management systems (SIEM) forming a threat intelligence platform. A threat intelligence platform aggregates log data from multiple disparate sources by deploying numerous collection agents and provides centralized analysis and reporting of an organization's security events for identifying malicious activity. Sysmon logs is a data source that has received considerable attention for endpoint visibility. Approaches for threat detection using Sysmon have been proposed mainly focusing on search engines (NoSQL database systems). This paper presents a new automated threat assessment system that relies on the analysis of continuous incoming feeds of Sysmon logs. The system is based on a cyber threat intelligence ontology and analyses Sysmon logs to classify software in different threat levels and augment cyber defensive capabilities through situational awareness, prediction, and automated courses of action.

• Mavroeidis, Vasileios; Vishi, Kamer & Jøsang, Audun (2018). A framework for data-driven physical security and insider threat detection, 2018 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538660515. p. 1108–1115. doi: 10.1109/ASONAM.2018.8508599. Full text in Research Archive Show summary

  This paper presents PS0, an ontological framework and a methodology for improving physical security and insider threat detection. PS0 can facilitate forensic data analysis and proactively mitigate insider threats by leveraging rule-based anomaly detection. In all too many cases, rule-based anomaly detection can detect employee deviations from organizational security policies. In addition, PS0 can be considered a security provenance solution because of its ability to fully reconstruct attack patterns. Provenance graphs can be further analyzed to identify deceptive actions and overcome analytical mistakes that can result in bad decision-making, such as false attribution. Moreover, the information can be used to enrich the available intelligence (about intrusion attempts) that can form use cases to detect and remediate limitations in the system, such as loosely-coupled provenance graphs that in many cases indicate weaknesses in the physical security architecture. Ultimately, validation of the framework through use cases demonstrates and proves that PS0 can improve an organization's security posture in terms of physical security and insider threat detection.

• Mavroeidis, Vasileios; Vishi, Kamer; Zych, Mateusz & Jøsang, Audun (2018). The impact of quantum computing on present cryptography. International Journal of Advanced Computer Science and Applications (IJACSA). ISSN 2158-107X. 9(3), p. 405–414. doi: 10.14569/IJACSA.2018.090354. Full text in Research Archive Show summary

  The aim of this paper is to elucidate the implications of quantum computing in present cryptography and to introduce the reader to basic post-quantum algorithms. In particular the reader can delve into the following subjects: present cryptographic schemes (symmetric and asymmetric), differences between quantum and classical computing, challenges in quantum computing, quantum algorithms (Shor’s and Grover’s), public key encryption schemes affected, symmetric schemes affected, the impact on hash functions, and post quantum cryptography. Specifically, the section of Post-Quantum Cryptography deals with different quantum key distribution methods and mathematical-based solutions, such as the BB84 protocol, lattice-based cryptography, multivariate-based cryptography, hash-based signatures and code-based cryptography.

• Gruschka, Nils; Mavroeidis, Vasileios; Vishi, Kamer & Jensen, Meiko (2018). Privacy Issues and Data Protection in Big Data: A Case Study Analysis under GDPR. In Abe, Naoki; Liu, Huan; Hu, Xiaohua; Ahmed, Nesreen; Qiao, Mu; Song, Yang; Kossmann, Donald; Liu, Bing; Lee, Kisung; Tang, Jiliang; He, Jingrui & Saltz, Jeffrey (Ed.), 2018 IEEE International Conference on Big Data (Big Data), Seattle, 10-13 Dec. 2018. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538650356. p. 5027–5033. doi: 10.1109/BigData.2018.8622621. Full text in Research Archive Show summary

  Big data has become a great asset for many organizations, promising improved operations and new business opportunities. However, big data has increased access to sensitive information that when processed can directly jeopardize the privacy of individuals and violate data protection laws. As a consequence, data controllers and data processors may be imposed tough penalties for non-compliance that can result even to bankruptcy. In this paper, we discuss the current state of the legal regulations and analyse different data protection and privacy-preserving techniques in the context of big data analysis. In addition, we present and analyse two real-life research projects as case studies dealing with sensitive data and actions for complying with the data regulation laws. We show which types of information might become a privacy risk, the employed privacy-preserving techniques in accordance with the legal requirements, and the influence of these techniques on the data processing phase and the research results.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Automatic Detection of Malware-Generated Domains with Recurrent Neural Models. Norsk Informasjonssikkerhetskonferanse (NISK). ISSN 1893-6563. Full text in Research Archive Show summary

  Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

• Mavroeidis, Vasileios & Bromander, Siri (2017). Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence. In Karampelas, Panagiotis & Brynielsson, Joel (Ed.), Proceedings of European Intelligence and Security Informatics Conference (EISIC) 2017. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538623855. doi: 10.1109/EISIC.2017.20. Full text in Research Archive Show summary

  Cyber threat intelligence is the provision of evidence-based knowledge about existing or emerging threats. Benefits from threat intelligence include increased situational awareness, efficiency in security operations, and improved prevention, detection, and response capabilities. To process, correlate, and analyze vast amounts of threat information and data and derive intelligence that can be shared and consumed in meaningful times, it is required to utilize structured, machine-readable formats that incorporate the industry-required expressivity while at the same time being unambiguous. To a large extent, this is achieved with technologies like ontologies, schemas, and taxonomies. This research evaluates the coverage and high-level conceptual expressivity of cyber-threat-intelligence-relevant ontologies, sharing standards, and taxonomies pertaining to the who, what, why, where, when, and how elements of threats and intrusions in addition to courses of action and technical indicators. The results confirm that little emphasis has been given to developing a comprehensive cyber threat intelligence ontology, with existing efforts not being thoroughly designed, non-interoperable and ambiguous, and lacking proper semantics and axioms for reasoning.

• Lison, Pierre & Mavroeidis, Vasileios (2017). Neural Reputation Models learned from Passive DNS data, IEEE Big Data 1st International Workshop on Big Data Analytic for Cyber Crime Investigation and Prevention 2017. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781538627150. p. 3662–3671. doi: 10.1109/BigData.2017.8258361. Full text in Research Archive Show summary

  Blacklists and whitelists are often employed to filter outgoing and incoming traffic on computer networks. One central function of these lists is to mitigate the security risks posed by malware threats by associating a reputation (for instance benign or malicious) to end-point hosts. The creation and maintenance of these lists is a complex and time-consuming process for security experts. As a consequence, blacklists and whitelists are prone to various errors, inconsistencies and omissions, as only a tiny fraction of end-point hosts are effectively covered by the reputation lists. In this paper, we present a machine learning model that is able to automatically detect whether domain names and IP addresses are benign, malicious or sinkholes. The model relies on a deep neural architecture and is trained on a large passive DNS database. Evaluation results demonstrate the effectiveness of the approach, as the model is able to detect malicious DNS records with a F1 score of 0.96. In other words, the model is able to detect 95 % of the malicious hosts with a false positive rate of 1:1000.

View all works in NVA

• Lison, Pierre (2018). Data-driven models of reputation in cyber-security. Full text in Research Archive Show summary

  In this talk, I will present our work on developing data-driven, predictive models of reputation (such as benign or malicious) for end-point hosts. I'll focus on two particular questions: 1) Malware often relies on so-called domain-generation algorithms (DGAs) to produce "fake" domain names that are used to connect compromised hosts with a command-and-control server. Many types of DGAs are been developed, from simple hashing techniques to more sophisticated approaches based on wordlists. I will show that these malware-generated domain names can be detected through recurrent neural networks such as LSTMs or GRUs. 2) The second part of the talk will focus on neural models of traffic reputation learned from passive DNS data. Passive DNS data are collections of inter-server DNS queries captured by sensors distributed on the network. This data is a goldmine for predicting whether a given domain name or IP address is likely to be benign or malicious. I will describe a deep neural architecture that predicts the reputation of end-point hosts with high accuracy. The neural model is trained on a large passive DNS dataset (745 million entries) and relies on a broad range of features extracted from the DNs graph.

• Lison, Pierre (2017). Automatic Detection of Malware-Generated Domains with Recurrent Neural Models. Full text in Research Archive Show summary

  Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

• Lison, Pierre (2017). Neural Reputation Models learned from Passive DNS Data. Full text in Research Archive
• Mavroeidis, Vasileios (2021). Towards Automated Threat-Informed Cyberspace Defense. Universitetet i Oslo. Full text in Research Archive Show summary

  To attain their goals, attackers have developed highly automated intelligence-driven attack capabilities. In contrast, defenders are still challenged by prolonged detection and response times due to their insufficient threat situational awareness and the fact that they heavily rely on manually executed defense operations. This thesis introduced and enhanced foundational technology in support of accomplishing automated threat-informed cyberspace defense. The research direction was influenced by the Integrated Adaptive Cyber Defense (IACD) framework that defines three fundamental capability requirements to realize autonomous defense environments that can detect, respond to, or outmaneuver cyber attacks in cyber-relevant time. In particular, the main contributions of this Ph.D. work are: - To enhance defenders' knowledge about adversaries, we introduced an ontological approach for representing and modeling their personas based on their defining characteristics. - We introduced a playbook standard for creating, documenting, and sharing security processes and procedures. Defenders can exchange such playbooks and utilize them to automate segments of their defense operations. - We supported the development of a machine-readable language that standardizes the way we command and control cyber defense systems.

View all works in NVA