AUTOMA: Automated generation of attack hypotheses and their variants for threat hunting using knowledge discovery

Threat hypothesis generation is a tedious task that requires a lot of time, effort, and elusive knowledge. In this paper, we propose Automa, which is a novel solution that automates the generation of the most relevant threat hypotheses and their variants using knowledge discovery.

Research paper

#threathunting #cybersecurity

Automa uses system telemetry in combination with a knowledge base of existing attacks, techniques, and their relationships to identify the most relevant hypotheses. Automa examines these hypotheses by performing evaluations like similarity, success, likelihood, and criticality assessments. These evaluations rely on the past occurrences of the techniques that are part of a hypothesis in the system telemetry and in the knowledge base.

Full abstract in IEEEXplore DOI: 10.1109/TNSM.2024.3378972

Authors

Boubakr Nour and Makan Pourzandi - Ericsson Research, Canada

Rushaan Kamran Qureshi and Mourad Debbabi - Gina Cody School of Engineering, Concordia University, Canada

Published in: IEEE Transactions on Network and Service Management (Volume: 21, Issue: 5, October 2024)

©2024 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse.

Download the paper

AUTOMA: Automated generation of attack hypotheses and their variants for threat hunting using knowledge discovery

pdf