Foreword |
|
ix | |
|
Preface |
|
xi | |
|
|
1 | (5) |
|
|
6 | (9) |
|
|
6 | (1) |
|
2.2 Inside Online Hacking Communities |
|
|
7 | (8) |
|
PART I UNDERSTANDING THE BEHAVIOR OF MALICIOUS HACKERS |
|
|
15 | (60) |
|
|
17 | (26) |
|
|
17 | (2) |
|
|
19 | (1) |
|
3.3 Leveraging Users' Reputation to Obtain Ground Truth Data |
|
|
20 | (2) |
|
|
22 | (1) |
|
|
23 | (10) |
|
|
24 | (1) |
|
|
24 | (4) |
|
3.5.3 Knowledge Transfer Behavior |
|
|
28 | (2) |
|
3.5.4 Structural Position |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
3.6 Supervised Learning Experiments |
|
|
33 | (7) |
|
3.6.1 Training and Testing |
|
|
33 | (7) |
|
|
40 | (1) |
|
|
41 | (2) |
|
4 Reasoning About Hacker Engagement |
|
|
43 | (17) |
|
|
43 | (2) |
|
|
45 | (1) |
|
4.3 Sequential Rule Mining Task |
|
|
45 | (4) |
|
4.3.1 Problem Formalization |
|
|
46 | (3) |
|
4.4 Experiments and Results |
|
|
49 | (9) |
|
|
49 | (5) |
|
4.4.2 Testing and Performance Analysis |
|
|
54 | (2) |
|
|
56 | (2) |
|
|
58 | (1) |
|
|
59 | (1) |
|
5 Uncovering Communities Of Malware And Exploit Vendors |
|
|
60 | (15) |
|
|
60 | (1) |
|
|
61 | (1) |
|
|
62 | (11) |
|
5.3.1 Creating a Bipartite Network of Vendors and Products |
|
|
62 | (2) |
|
5.3.2 Clustering the Products in Product Categories |
|
|
64 | (1) |
|
5.3.3 Splitting the Marketplaces into Two Disjoint Sets |
|
|
64 | (2) |
|
5.3.4 Creating Bipartite Networks of Vendors and Product Categories |
|
|
66 | (2) |
|
5.3.5 Projecting Bipartite Networks of Vendors and Product Categories into a Monopartite Network of Vendors |
|
|
68 | (1) |
|
5.3.6 Finding Communities of Vendors in Each Set of Markets |
|
|
68 | (3) |
|
5.3.7 Calculating the Community Overlapping between the Two Sets of Markets |
|
|
71 | (2) |
|
5.3.8 Significance Analysis |
|
|
73 | (1) |
|
|
73 | (1) |
|
|
74 | (1) |
|
PART II PREDICTING IMMINENT CYBER-THREATS |
|
|
75 | (114) |
|
6 Identifying Exploits In The Wild Proactively |
|
|
77 | (31) |
|
|
77 | (3) |
|
|
80 | (2) |
|
6.3 Exploit Prediction Model |
|
|
82 | (6) |
|
|
83 | (3) |
|
6.3.2 Feature Description |
|
|
86 | (2) |
|
6.4 Vulnerability and Exploit Analysis |
|
|
88 | (4) |
|
|
92 | (9) |
|
6.5.1 Performance Evaluation |
|
|
93 | (1) |
|
|
94 | (7) |
|
6.6 Adversarial Data Manipulation |
|
|
101 | (3) |
|
|
104 | (1) |
|
|
105 | (2) |
|
|
107 | (1) |
|
7 Predicting Enterprise-Targeted External Cyber-Attacks |
|
|
108 | (19) |
|
|
108 | (2) |
|
|
110 | (3) |
|
|
110 | (1) |
|
|
111 | (2) |
|
|
113 | (1) |
|
7.3.1 Online Hacker Community Infrastructure |
|
|
113 | (1) |
|
7.3.2 Enterprise-Relevant External Threats |
|
|
113 | (1) |
|
7.4 Extracting Indicators of Cyber-threats |
|
|
114 | (1) |
|
7.5 A Novel Logic Programming-Based Cyber-threat Prediction System |
|
|
114 | (2) |
|
|
115 | (1) |
|
|
115 | (1) |
|
7.6 Predicting Enterprise-Targeted Attacks |
|
|
116 | (2) |
|
7.6.1 Experimental Settings |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
|
118 | (2) |
|
7.8 An Extension to the Current Approach |
|
|
120 | (4) |
|
7.8.1 Extracting Entity Tags |
|
|
121 | (1) |
|
|
122 | (2) |
|
|
124 | (2) |
|
|
126 | (1) |
|
8 Bringing Social Network Analysis To Aid In Cyber-Attack Prediction |
|
|
127 | (36) |
|
|
127 | (2) |
|
|
129 | (4) |
|
8.2.1 External Threats (GT) |
|
|
129 | (1) |
|
8.2.2 Online Hacker Forum Data |
|
|
129 | (3) |
|
|
132 | (1) |
|
|
133 | (1) |
|
8.4 Framework for Attack Prediction |
|
|
133 | (17) |
|
8.4.1 Step 1: Feature Engineering |
|
|
135 | (8) |
|
8.4.2 Step 2: Training Models for Prediction |
|
|
143 | (5) |
|
8.4.3 Step 3: Attack Prediction |
|
|
148 | (2) |
|
8.5 Experiments and Results |
|
|
150 | (7) |
|
|
150 | (1) |
|
|
151 | (6) |
|
|
157 | (3) |
|
8.6.1 Prediction in High-Activity Weeks |
|
|
157 | (1) |
|
8.6.2 Experiments with Another Security Breach Dataset |
|
|
158 | (2) |
|
|
160 | (2) |
|
|
162 | (1) |
|
9 Finding At-Risk Systems Without Software Vulnerability Identifiers (Cves) |
|
|
163 | (20) |
|
|
163 | (2) |
|
|
165 | (1) |
|
|
166 | (2) |
|
|
166 | (2) |
|
|
168 | (5) |
|
|
173 | (6) |
|
9.5.1 Data Representation |
|
|
174 | (1) |
|
9.5.2 Supervised Learning Approaches |
|
|
175 | (1) |
|
|
175 | (1) |
|
9.5.4 Baseline Model (BM) |
|
|
175 | (1) |
|
9.5.5 Reasoning Framework (RFrame) |
|
|
176 | (3) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
181 | (2) |
|
|
183 | (6) |
|
|
184 | (2) |
|
|
186 | (3) |
References |
|
189 | (14) |
Index |
|
203 | |