Výsledky vyhledávání - "Venkatakrishnan, V."

Report

OSTINATO: Cross-host Attack Correlation Through Attack Activity Similarity Detection

Autor: Ghosh, Sutanu Kumar, Satvat, Kiavash, Gjomemo, Rigel, Venkatakrishnan, V. N.

Modern attacks against enterprises often have multiple targets inside the enterprise network. Due to the large size of these networks and increasingly stealthy attacks, attacker activities spanning multiple hosts are extremely difficult to correlate

Externí odkaz: http://arxiv.org/abs/2312.09321

Zobrazit plný text záznamu

Report

EXTRACTOR: Extracting Attack Behavior from Threat Reports

Autor: Satvat, Kiavash, Gjomemo, Rigel, Venkatakrishnan, V. N.

The knowledge on attacks contained in Cyber Threat Intelligence (CTI) reports is very important to effectively identify and quickly respond to cyber threats. However, this knowledge is often embedded in large amounts of text, and therefore difficult

Externí odkaz: http://arxiv.org/abs/2104.08618

Zobrazit plný text záznamu

Report

POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting

Autor: Milajerdi, Sadegh M., Eshete, Birhanu, Gjomemo, Rigel, Venkatakrishnan, V. N.

Cyber threat intelligence (CTI) is being used to search for indicators of attacks that might have compromised an enterprise network for a long time without being discovered. To have a more effective analysis, CTI open standards have incorporated desc

Externí odkaz: http://arxiv.org/abs/1910.00056

Zobrazit plný text záznamu

Report

ProPatrol: Attack Investigation via Extracted High-Level Tasks

Autor: Milajerdi, Sadegh M., Eshete, Birhanu, Gjomemo, Rigel, Venkatakrishnan, V. N.

Kernel audit logs are an invaluable source of information in the forensic investigation of a cyber-attack. However, the coarse granularity of dependency information in audit logs leads to the construction of huge attack graphs which contain false or

Externí odkaz: http://arxiv.org/abs/1810.05711

Zobrazit plný text záznamu

Report

HOLMES: Real-time APT Detection through Correlation of Suspicious Information Flows

Autor: Milajerdi, Sadegh M., Gjomemo, Rigel, Eshete, Birhanu, Sekar, R., Venkatakrishnan, V. N.

In this paper, we present HOLMES, a system that implements a new approach to the detection of Advanced and Persistent Threats (APTs). HOLMES is inspired by several case studies of real-world APTs that highlight some common goals of APT actors. In a n

Externí odkaz: http://arxiv.org/abs/1810.01594

Zobrazit plný text záznamu

Report

Attack Analysis Results for Adversarial Engagement 1 of the DARPA Transparent Computing Program

Autor: Eshete, Birhanu, Gjomemo, Rigel, Hossain, Md Nahid, Momeni, Sadegh, Sekar, R., Stoller, Scott, Venkatakrishnan, V. N., Wang, Junao

This report presents attack analysis results of the first adversarial engagement event stream for the first engagement of the DARPA TC program conducted in October 2016. The analysis was performed by Stony Brook University and University of Illinois

Externí odkaz: http://arxiv.org/abs/1610.06936

Zobrazit plný text záznamu