NDLI: Machine actionable indicators of compromise

Content Provider	IEEE Xplore Digital Library
Author	Rhoades, D.
Copyright Year	2014
Description	Author affiliation: Chief Eng. Cybersecurity, Southern California Edison, Irwindale, CA, USA (Rhoades, D.)
Abstract	IT departments are overwhelmed by an ever-increasing flood of Indicators of Compromise (IOC) detailing illicit activity that may occur on their networks and systems. The characterization of the threats involved varies with the source of the information and each notice requires human operators to sift through data as displayed on a Web page or in a PDF, update monitoring appliances and if detected, decide on appropriate remediation. There are initiatives to enable the IOC data to be exchanged in a common format. For example, STIX and OpenIOC, but this is only the first step in the workflow. Recently, Lawrence Livermore National Laboratory (LLNL) has led a team of researchers in the development of a system to describe the compromise in a way that it can be automatically detected if present AND include possible remediation for the exploit in the same machine-readable package. The first part of this paper details the industry ecosystem for Enterprise exploits: characterization in a standard and consistent manner, exchange of data between organizations and the limited scope of remediation. The next section of this paper describes the research being performed by LLNL and its partners to leverage the Enterprise exploit model within the ICS community. The research consists of three parts: (a) a representation of exploits to include information required for their detection on the target system, (b) a language to describe remediation specific for an exploit, and (c) processing algorithms to convert those generic proscriptions into actions for specific appliances. Finally, as this research is ongoing, this paper presents the plan of efforts going forward, the expected challenges yet to come, and some resulting items to be open-sourced for continued community involvement.
Starting Page	1
Ending Page	5
File Size	1324995
Page Count	5
File Format	PDF
ISBN	9781479935307
ISSN	21530742
e-ISBN	9781479935321
DOI	10.1109/CCST.2014.6987016
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-10-13
Publisher Place	Italy
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Malware Ecosystems Communities Standards Vocabulary ICS XML IOC Remediation M2M STIX CybOX
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in